LegalCopyright:	Copyright \xa9 2002-2013 RealVNC Ltd.
InternalName:	vncchat
FileVersion:	5.0.6 (r113416)
CompanyName:	RealVNC Ltd
LegalTrademarks:	VNC is a registered trademark of RealVNC Ltd. in the U.S. and in other countries.
ProductName:	VNC\xae
ProductVersion:	5.0.6 (r113416)
ProgramName:	VNC\xae Chat
FileDescription:	VNC\xae Chat
OriginalFilename:	vncchat.exe
Translation:	0x0809 0x04b0

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00002000	0x000121c4	0x00012200	7.1208177676
.sdata	0x00016000	0x000001e8	0x00000200	6.63844624893
.rsrc	0x00018000	0x0000423e	0x00004400	6.21228282349
.reloc	0x0001e000	0x0000000c	0x00000200	0.101910425663

IP Address
10.129.0.11
10.129.0.255

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
21:05:12,055	968	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,055	968	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,055	968	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,055	968	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,055	968	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,055	968	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,055	968	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,055	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,065	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,065	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,065	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,065	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,065	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,065	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,065	536	LdrLoadDll	Flags => 1244152 BaseAddress => 0x77dd0000 FileName => ADVAPI32.dll	SUCCESS	0x00000000
21:05:12,065	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyExW FunctionAddress => 0x77dd6a9f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,065	536	RegOpenKeyExW	Handle => 0x0000009c Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\Policy\	SUCCESS	0x00000000
21:05:12,065	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryInfoKeyW FunctionAddress => 0x77de49ae ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,065	536	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 9 KeyHandle => 0x0000009c SubKeyCount => 5 Class =>	SUCCESS	0x00000000
21:05:12,065	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumKeyExW FunctionAddress => 0x77dd7bc9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,065	536	RegEnumKeyExW	Index => 4 Handle => 0x0000009c Name => v4.0 Class =>	SUCCESS	0x00000000
21:05:12,065	536	RegEnumKeyExW	Index => 3 Handle => 0x0000009c Name => v2.0 Class =>	SUCCESS	0x00000000
21:05:12,065	536	RegEnumKeyExW	Index => 2 Handle => 0x0000009c Name => Upgrades Class =>	SUCCESS	0x00000000
21:05:12,065	536	RegEnumKeyExW	Index => 1 Handle => 0x0000009c Name => Standards Class =>	SUCCESS	0x00000000
21:05:12,075	536	RegEnumKeyExW	Index => 0 Handle => 0x0000009c Name => AppPatch Class =>	SUCCESS	0x00000000
21:05:12,075	536	RegOpenKeyExW	Handle => 0x000000a0 Registry => 0x0000009c SubKey => v4.0	SUCCESS	0x00000000
21:05:12,075	536	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 24 MaxValueNameLength => 5 ValueCount => 1 MaxSubKeyLength => 0 KeyHandle => 0x000000a0 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
21:05:12,075	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumValueW FunctionAddress => 0x77dd7edd ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,075	536	RegEnumValueW	Index => 0 Handle => 0x000000a0 Data => 3\x000\x003\x001\x009\x00-\x003\x000\x003\x001\x009\x00\x00\x00 ValueName => 30319	SUCCESS	0x00000000
21:05:12,075	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCloseKey FunctionAddress => 0x77dd6c17 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,075	536	RegCloseKey	Handle => 0x000000a0	SUCCESS	0x00000000
21:05:12,085	536	RegOpenKeyExW	Handle => 0x000000a0 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,085	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueExW FunctionAddress => 0x77dd6fef ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x000000a0 DataLength => 72 ValueName => InstallRoot Type => 1	SUCCESS	0x00000000
21:05:12,085	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueExW FunctionAddress => 0x77dd6fef ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x000000a0 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00.\x00N\x00E\x00T\x00\\x00F\x00r\x00a\x00m\x00e\x00w\x00o\x00r\x00k\x00\\x00\x00\x00 ValueName => InstallRoot	SUCCESS	0x00000000
21:05:12,085	536	RegCloseKey	Handle => 0x000000a0	SUCCESS	0x00000000
21:05:12,085	536	FindFirstFileExW	FileName => C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll	SUCCESS	0x00168b98
21:05:12,085	536	RegCloseKey	Handle => 0x0000009c	SUCCESS	0x00000000
21:05:12,085	536	RegOpenKeyExW	Handle => 0x0000009c Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x0000009c DataLength => 72 ValueName => InstallRoot Type => 1	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x0000009c Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00.\x00N\x00E\x00T\x00\\x00F\x00r\x00a\x00m\x00e\x00w\x00o\x00r\x00k\x00\\x00\x00\x00 ValueName => InstallRoot	SUCCESS	0x00000000
21:05:12,085	536	RegCloseKey	Handle => 0x0000009c	SUCCESS	0x00000000
21:05:12,085	536	FindFirstFileExW	FileName => C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll	SUCCESS	0x00168b98
21:05:12,085	536	RegOpenKeyExW	Handle => 0x0000009c Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x0000009c DataLength => 72 ValueName => InstallRoot Type => 1	SUCCESS	0x00000000
21:05:12,085	536	RegQueryValueExW	Handle => 0x0000009c Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00.\x00N\x00E\x00T\x00\\x00F\x00r\x00a\x00m\x00e\x00w\x00o\x00r\x00k\x00\\x00\x00\x00 ValueName => InstallRoot	SUCCESS	0x00000000
21:05:12,085	536	RegCloseKey	Handle => 0x0000009c	SUCCESS	0x00000000
21:05:12,085	536	LdrLoadDll	Flags => 1243892 BaseAddress => 0x603b0000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll	SUCCESS	0x00000000
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterShimImplCallback FunctionAddress => 0x603b6975 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterShimImplCleanupCallback FunctionAddress => 0x79007eb0 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetShellShimInstance FunctionAddress => 0x7900c90c ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OnShimDllMainCalled FunctionAddress => 0x603b43ef ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _CorExeMain_RetAddr FunctionAddress => 0x7900c964 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,095	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _CorExeMain FunctionAddress => 0x603b5573 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,095	536	RegOpenKeyExW	Handle => 0x000000a4 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,095	536	RegQueryValueExW	Handle => 0x000000a4 DataLength => 72 ValueName => InstallRoot Type => 1	SUCCESS	0x00000000
21:05:12,095	536	RegQueryValueExW	Handle => 0x000000a4 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00.\x00N\x00E\x00T\x00\\x00F\x00r\x00a\x00m\x00e\x00w\x00o\x00r\x00k\x00\\x00\x00\x00 ValueName => InstallRoot	SUCCESS	0x00000000
21:05:12,095	536	RegCloseKey	Handle => 0x000000a4	SUCCESS	0x00000000
21:05:12,105	536	FindFirstFileExW	FileName => C:\WINDOWS\Microsoft.NET\Framework\\*	SUCCESS	0x0016aab8
21:05:12,105	536	NtQueryDirectoryFile	FileName => FileHandle => 0x000000a4 FileInformation => h\x00\x00\x00\x00\x00\x00\x00\xc0\x05\x11\\xe3\x91\xcf\x01\xdfR\xcd`\xaf\x91\xcf\x010$\xeb,\xe6\x91\xcf\x010$\xeb,\xe6\x91\xcf\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xe5\xcc\x01\xc7\xca\x01PV\xb2j\xe3\x91\xcf\x01\x00\xfe\xe5\xcc\x01\xc7\xca\x01PV\xb2j\xe3\x91\xcf\x01PS\x01\x00\x00\x00\x00\x00\x00`\x01\x00\x00\x00\x00\x00 \x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x18\x00N\x00E\x00T\x00F\x00X\x00S\x00~\x001\x00.\x00E\x00X\x00E\x00N\x00E\x00T\x00F\x00X\x00S\x00B\x00S\x001\x000\x00.\x00e\x00x\x00e\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\xa6\xa0qD\x16\xc8\x01\x80d\xed\xdc\xe5\x91\xcf\x01	SUCCESS	0x00000000
21:05:12,105	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\clr.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,105	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,105	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\clr.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,105	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,115	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\clr.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,115	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x000000a8	SUCCESS	0x00000000
21:05:12,115	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\clr.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x000000a8	SUCCESS	0x00000000
21:05:12,115	536	NtQueryDirectoryFile	FileName => FileHandle => 0x000000a4 FileInformation =>	FAILURE	2147483654
21:05:12,115	536	LdrLoadDll	Flags => 1242632 BaseAddress => 0x77f60000 FileName => SHLWAPI.dll	SUCCESS	0x00000000
21:05:12,115	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UrlIsW FunctionAddress => 0x77f6bcac ModuleHandle => 0x77f60000	SUCCESS	0x00000000
21:05:12,115	536	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,115	536	RegOpenKeyExW	Handle => 0x000000a4 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,115	536	RegQueryValueExW	Handle => 0x000000a4 DataLength => 4 ValueName => UseLegacyV2RuntimeActivationPolicyDefaultValue Type => 1242784	FAILURE	0x00000002
21:05:12,115	536	RegCloseKey	Handle => 0x000000a4	SUCCESS	0x00000000
21:05:12,115	536	RegOpenKeyExW	Handle => 0x000000a4 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,125	536	RegQueryValueExW	Handle => 0x000000a4 DataLength => 4 ValueName => OnlyUseLatestCLR Type => 1242848	FAILURE	0x00000002
21:05:12,125	536	RegCloseKey	Handle => 0x000000a4	SUCCESS	0x00000000
21:05:12,125	536	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000a4	SUCCESS	0x00000000
21:05:12,125	536	NtQueryInformationFile	FileHandle => 0x000000a4 FileInformation => \x00p\x01\x00\x00\x00\x00\x00\x00n\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:12,125	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000a8 FileHandle => 0x000000a4	SUCCESS	0x00000000
21:05:12,125	536	ZwMapViewOfSection	SectionOffset => 0x0012f6d4 SectionHandle => 0x000000a8 ProcessHandle => 0xffffffff BaseAddress => 0x00b40000	SUCCESS	0x00000000
21:05:12,135	536	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000a8	SUCCESS	0x00000000
21:05:12,135	536	NtQueryInformationFile	FileHandle => 0x000000a8 FileInformation => \x00p\x01\x00\x00\x00\x00\x00\x00n\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:12,135	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000a4 FileHandle => 0x000000a8	SUCCESS	0x00000000
21:05:12,135	536	ZwMapViewOfSection	SectionOffset => 0x0012f6d4 SectionHandle => 0x000000a4 ProcessHandle => 0xffffffff BaseAddress => 0x00b40000	SUCCESS	0x00000000
21:05:12,135	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\.NETFramework\Policy\Standards	FAILURE	0x00000002
21:05:12,145	536	RegOpenKeyExW	Handle => 0x000000a8 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\Policy\Standards	SUCCESS	0x00000000
21:05:12,145	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000000a8 SubKey => v2.0.50727	FAILURE	0x00000002
21:05:12,145	536	RegCloseKey	Handle => 0x000000a8	SUCCESS	0x00000000
21:05:12,145	536	RegOpenKeyExW	Handle => 0x000000a8 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Fusion	SUCCESS	0x00000000
21:05:12,145	536	RegQueryValueExW	Handle => 0x000000a8 DataLength => 4 ValueName => NoClientChecks Type => 1241776	FAILURE	0x00000002
21:05:12,145	536	RegCloseKey	Handle => 0x000000a8	SUCCESS	0x00000000
21:05:12,145	536	NtCreateFile	ShareAccess => 7 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll DesiredAccess => 0x00120080 CreateDisposition => 1 FileHandle => 0x000000a8	SUCCESS	0x00000000
21:05:12,346	536	LdrLoadDll	Flags => 1244320 BaseAddress => 0x79e70000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll	SUCCESS	0x00000000
21:05:12,346	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetLoadedByMscoree FunctionAddress => 0x603bf564 ModuleHandle => 0x79e70000	FAILURE	3221225785
21:05:12,346	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _CorExeMain FunctionAddress => 0x79fb9647 ModuleHandle => 0x79e70000	SUCCESS	0x00000000
21:05:12,356	536	LdrGetDllHandle	ModuleHandle => 0x79e70000 FileName => mscorwks.dll	SUCCESS	0x00000000
21:05:12,356	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCLRFunction FunctionAddress => 0x79ee30b4 ModuleHandle => 0x79e70000	SUCCESS	0x00000000
21:05:12,356	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\.NETFramework	FAILURE	0x00000002
21:05:12,356	536	RegOpenKeyExW	Handle => 0x000000b0 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,356	536	RegQueryValueExW	Handle => 0x000000b0 DataLength => 4 ValueName => DisableConfigCache Type => 1244728	FAILURE	0x00000002
21:05:12,356	536	RegCloseKey	Handle => 0x000000b0	SUCCESS	0x00000000
21:05:12,366	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\.NETFramework	FAILURE	0x00000002
21:05:12,366	536	RegOpenKeyExW	Handle => 0x000000b0 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:12,366	536	RegEnumValueW	Index => 0 Handle => 0x000000b0 DataLength => 0 ValueName => InstallRoot Type => 1	SUCCESS	0x00000000
21:05:12,366	536	RegEnumValueW	Index => 1 Handle => 0x000000b0 DataLength => 0 ValueName => InstallRoot Type => 1244780	FAILURE	0x00000103
21:05:12,376	536	LdrLoadDll	Flags => 1244520 BaseAddress => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IEE FunctionAddress => 0x79008a18 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IEE_RetAddr FunctionAddress => 0x7900cc94 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IEE FunctionAddress => 0x603bfd47 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IEE FunctionAddress => 0x79fa6d3a ModuleHandle => 0x79e70000	SUCCESS	0x00000000
21:05:12,376	536	VirtualProtectEx	Protection => 0x00000040 ProcessHandle => 0xffffffff Address => 0x79e71884 Size => 0x00000004	SUCCESS	0x00000001
21:05:12,376	536	VirtualProtectEx	Protection => 0x00000020 ProcessHandle => 0xffffffff Address => 0x79e71884 Size => 0x00000004	SUCCESS	0x00000001
21:05:12,376	536	LdrGetDllHandle	ModuleHandle => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStartupFlags FunctionAddress => 0x79008a44 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStartupFlags_RetAddr FunctionAddress => 0x7900c9b8 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStartupFlags FunctionAddress => 0x603c007b ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetHostConfigurationFile FunctionAddress => 0x79008a70 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetHostConfigurationFile_RetAddr FunctionAddress => 0x7900cc30 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetHostConfigurationFile FunctionAddress => 0x603c0262 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCORVersion_RetAddr FunctionAddress => 0x7900ca80 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCORVersion FunctionAddress => 0x603bf1dd ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetDllHandle	ModuleHandle => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCORSystemDirectory FunctionAddress => 0x790031d0 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCORSystemDirectory_RetAddr FunctionAddress => 0x603bfef1 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,376	536	RegOpenKeyExW	Handle => 0x000000ac Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\Policy\AppPatch	SUCCESS	0x00000000
21:05:12,376	536	RegOpenKeyExW	Handle => 0x000000b4 Registry => 0x000000ac SubKey => v4.0.30319.00000	SUCCESS	0x00000000
21:05:12,376	536	RegCloseKey	Handle => 0x000000ac	SUCCESS	0x00000000
21:05:12,376	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000000b4 SubKey => mscorwks.dll	FAILURE	0x00000002
21:05:12,376	536	RegCloseKey	Handle => 0x000000b4	SUCCESS	0x00000000
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateConfigStream_RetAddr FunctionAddress => 0x7900cb5c ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,376	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateConfigStream FunctionAddress => 0x603b4888 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,386	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000b4	SUCCESS	0x00000000
21:05:12,396	536	NtReadFile	Buffer => <?xml version="1.0" encoding="UTF-8"?><!-- Please refer to machine.config.comments for a description and the default values of each configuration section. For a full documentation of the schema please refer to http://go.microsoft.com/ FileHandle => 0x000000b4	SUCCESS	0x00000000
21:05:12,406	536	NtReadFile	Buffer => Xml.Serialization.Configuration.SchemaImporterExtensionsSection, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/> <section name="dateTimeSerialization" type="System.Xml.Serialization.Configuration.DateTimeSerializatio FileHandle => 0x000000b4	SUCCESS	0x00000000
21:05:12,406	536	NtReadFile	Buffer => b03f5f7f11d50a3a" allowDefinition="MachineToApplication"/> <section name="membership" type="System.Web.Configuration.MembershipSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplicat FileHandle => 0x000000b4	SUCCESS	0x00000000
21:05:12,406	536	NtReadFile	Buffer => <section name="sqlCacheDependency" type="System.Web.Configuration.SqlCacheDependencySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication"/> </sectionGroup> </sectionGroup> FileHandle => 0x000000b4	SUCCESS	0x00000000
21:05:12,406	536	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,406	536	LdrLoadDll	Flags => 1244540 BaseAddress => 0x7c900000 FileName => ntdll	SUCCESS	0x00000000
21:05:12,406	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlUnwind FunctionAddress => 0x7c92aba5 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
21:05:12,406	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:12,406	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsWow64Process FunctionAddress => 0x7c815229 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,406	536	RegOpenKeyExW	Handle => 0x000000b4 Registry => 0x80000002 SubKey => Software\Microsoft\Fusion	SUCCESS	0x00000000
21:05:12,416	536	RegOpenKeyExW	Handle => 0x000000ac Registry => 0x80000002 SubKey => Software\Microsoft\Fusion	SUCCESS	0x00000000
21:05:12,416	536	RegQueryValueExW	Handle => 0x000000ac DataLength => 520 ValueName => CacheLocation Type => 1241904	FAILURE	0x00000002
21:05:12,416	536	RegCloseKey	Handle => 0x000000ac	SUCCESS	0x00000000
21:05:12,416	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,416	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemWindowsDirectoryW FunctionAddress => 0x7c80adb9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,416	536	RegOpenKeyExW	Handle => 0x000000ac Registry => 0x80000002 SubKey => Software\Microsoft\Fusion	SUCCESS	0x00000000
21:05:12,416	536	RegQueryValueExW	Handle => 0x000000ac DataLength => 4 ValueName => DownloadCacheQuotaInKB Type => 1243500	FAILURE	0x00000002
21:05:12,416	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Fusion	FAILURE	0x00000002
21:05:12,416	536	RegCloseKey	Handle => 0x000000ac	SUCCESS	0x00000000
21:05:12,416	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => EnableLog Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => LoggingLevel Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => ForceLog Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => LogFailures Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => LogResourceBinds Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => UseLegacyIdentityFormat Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegQueryValueExW	Handle => 0x000000b4 DataLength => 4 ValueName => DisableMSIPeek Type => 1243524	FAILURE	0x00000002
21:05:12,426	536	RegCloseKey	Handle => 0x000000b4	SUCCESS	0x00000000
21:05:12,436	536	LdrGetDllHandle	ModuleHandle => 0x77dd0000 FileName => advapi32	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AllocateAndInitializeSid FunctionAddress => 0x77dd7cb9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcessToken FunctionAddress => 0x77dd797b ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTokenInformation FunctionAddress => 0x77dd72f5 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InitializeAcl FunctionAddress => 0x77dd7cf9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AddAccessAllowedAce FunctionAddress => 0x77dd7d21 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FreeSid FunctionAddress => 0x77dd7ca8 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	NtCreateSection	ObjectAttributes => C:\Global\Cor_Private_IPCBlock_504 DesiredAccess => 0x000f0007 SectionHandle => 0x000000ac FileHandle => 0x00000000	SUCCESS	0x00000000
21:05:12,436	536	ZwMapViewOfSection	SectionOffset => 0x0012f8d8 SectionHandle => 0x000000ac ProcessHandle => 0xffffffff BaseAddress => 0x00b60000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetDllHandle	ModuleHandle => 0x77dd0000 FileName => advapi32	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AllocateAndInitializeSid FunctionAddress => 0x77dd7cb9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcessToken FunctionAddress => 0x77dd797b ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTokenInformation FunctionAddress => 0x77dd72f5 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InitializeAcl FunctionAddress => 0x77dd7cf9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AddAccessAllowedAce FunctionAddress => 0x77dd7d21 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,436	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FreeSid FunctionAddress => 0x77dd7ca8 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,446	536	NtCreateSection	ObjectAttributes => C:\Global\Cor_Public_IPCBlock_504 DesiredAccess => 0x000f0007 SectionHandle => 0x000000b8 FileHandle => 0x00000000	SUCCESS	0x00000000
21:05:12,446	536	ZwMapViewOfSection	SectionOffset => 0x0012f8d4 SectionHandle => 0x000000b8 ProcessHandle => 0xffffffff BaseAddress => 0x00b70000	SUCCESS	0x00000000
21:05:12,446	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetThreadStackGuarantee FunctionAddress => 0x79f53efc ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FlsSetValue FunctionAddress => 0x79fa6b20 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FlsGetValue FunctionAddress => 0x79fa6b14 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FlsAlloc FunctionAddress => 0x79fa6b08 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FlsFree FunctionAddress => 0x79fa6b00 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	CreateThread	ThreadId => 1068 StartRoutine => 0x79f4e71f Parameter => 0x00000000 CreationFlags => 4	SUCCESS	0x000000f0
21:05:12,446	536	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x000000f0	SUCCESS	0x00000000
21:05:12,446	536	NtCreateMutant	Handle => 0x000000f4 InitialOwner => 1 MutexName =>	SUCCESS	0x00000000
21:05:12,446	536	IsDebuggerPresent		FAILURE	0x00000000
21:05:12,446	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AddVectoredContinueHandler FunctionAddress => 0x79f4e2b8 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RemoveVectoredContinueHandler FunctionAddress => 0x79f4e298 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,446	1068	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,456	536	VirtualProtectEx	Protection => 0x00000040 ProcessHandle => 0xffffffff Address => 0x79e75530 Size => 0x00000218	SUCCESS	0x00000001
21:05:12,456	536	RegOpenKeyExW	Handle => 0x00000114 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets	SUCCESS	0x00000000
21:05:12,456	536	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x00000114 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 0 Handle => 0x00000114 Name => Internet Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegOpenKeyExW	Handle => 0x00000118 Registry => 0x00000114 SubKey => Internet	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 0 Handle => 0x00000118 Name => MediaPermission Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 1 Handle => 0x00000118 Name => WebBrowserPermission Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 2 Handle => 0x00000118 Name => WebBrowserPermission Class =>	FAILURE	0x00000103
21:05:12,456	536	RegCloseKey	Handle => 0x00000118	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 1 Handle => 0x00000114 Name => LocalIntranet Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegOpenKeyExW	Handle => 0x00000118 Registry => 0x00000114 SubKey => LocalIntranet	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 0 Handle => 0x00000118 Name => MediaPermission Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 1 Handle => 0x00000118 Name => WebBrowserPermission Class =>	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 2 Handle => 0x00000118 Name => WebBrowserPermission Class =>	FAILURE	0x00000103
21:05:12,456	536	RegCloseKey	Handle => 0x00000118	SUCCESS	0x00000000
21:05:12,456	536	RegEnumKeyExW	Index => 2 Handle => 0x00000114 Name => LocalIntranet Class =>	FAILURE	0x00000103
21:05:12,456	536	RegCloseKey	Handle => 0x00000114	SUCCESS	0x00000000
21:05:12,456	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,456	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,456	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,456	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
21:05:12,456	536	LdrLoadDll	Flags => 1242092 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
21:05:12,456	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ConvertSidToStringSidW FunctionAddress => 0x77ddf0ff ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,456	536	RegOpenKeyExW	Handle => 0x00000118 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
21:05:12,456	536	RegCloseKey	Handle => 0x00000118	SUCCESS	0x00000000
21:05:12,486	536	LdrLoadDll	Flags => 1242128 BaseAddress => 0x7c9c0000 FileName => shell32.dll	SUCCESS	0x00000000
21:05:12,486	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000	SUCCESS	0x00000000
21:05:12,486	536	RegCreateKeyExW	Handle => 0x0000011c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
21:05:12,486	536	RegQueryValueExW	Handle => 0x0000011c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData	SUCCESS	0x00000000
21:05:12,486	536	RegCloseKey	Handle => 0x0000011c	SUCCESS	0x00000000
21:05:12,486	536	RegCreateKeyExW	Handle => 0x0000011c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
21:05:12,486	536	RegSetValueExW	Handle => 0x0000011c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1	SUCCESS	0x00000000
21:05:12,486	536	RegCloseKey	Handle => 0x0000011c	SUCCESS	0x00000000
21:05:12,486	536	NtCreateFile	ShareAccess => 5 FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225530
21:05:12,486	536	NtCreateFile	ShareAccess => 5 FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225530
21:05:12,486	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy	FAILURE	0x00000002
21:05:12,486	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => Kernel32.dll	SUCCESS	0x00000000
21:05:12,486	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWriteWatch FunctionAddress => 0x7c85f6d2 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,486	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ResetWriteWatch FunctionAddress => 0x7c85f70b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,486	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x00d00000	SUCCESS	0x00000000
21:05:12,486	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => Kernel32.dll	SUCCESS	0x00000000
21:05:12,486	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateMemoryResourceNotification FunctionAddress => 0x7c839672 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,486	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => QueryMemoryResourceNotification FunctionAddress => 0x7c8395f0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	536	CreateThread	ThreadId => 1080 StartRoutine => 0x79f959e8 Parameter => 0x00172f00 CreationFlags => 4	SUCCESS	0x0000014c
21:05:12,496	536	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x0000014c	SUCCESS	0x00000000
21:05:12,496	536	RegOpenKeyExW	Handle => 0x00000154 Registry => 0x80000002 SubKey => Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32	SUCCESS	0x00000000
21:05:12,496	536	RegQueryValueExW	Handle => 0x00000154 Data => 18 ValueName => LatestIndex	SUCCESS	0x00000000
21:05:12,496	536	RegOpenKeyExW	Handle => 0x00000158 Registry => 0x80000002 SubKey => Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32	SUCCESS	0x00000000
21:05:12,496	536	RegQueryValueExW	Handle => 0x00000158 Data => 18 ValueName => LatestIndex	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,496	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,506	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index12.dat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000164	SUCCESS	0x00000000
21:05:12,506	536	RegOpenKeyExW	Handle => 0x00000168 Registry => 0x00000158 SubKey => index12	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000168 Data => ValueName => NIUsageMask	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000168 Data => ValueName => ILUsageMask	SUCCESS	0x00000000
21:05:12,516	536	RegCloseKey	Handle => 0x00000168	SUCCESS	0x00000000
21:05:12,516	536	RegCloseKey	Handle => 0x00000154	SUCCESS	0x00000000
21:05:12,516	536	RegOpenKeyExW	Handle => 0x00000154 Registry => 0x00000158 SubKey => NI\181938c6\3c74e9a9	SUCCESS	0x00000000
21:05:12,516	536	RegEnumKeyExW	Index => 0 Handle => 0x00000154 Name => 1 Class =>	SUCCESS	0x00000000
21:05:12,516	536	RegEnumKeyExW	Index => 1 Handle => 0x00000154 Name => 1 Class =>	FAILURE	0x00000103
21:05:12,516	536	RegCloseKey	Handle => 0x00000154	SUCCESS	0x00000000
21:05:12,516	536	RegOpenKeyExW	Handle => 0x00000154 Registry => 0x00000158 SubKey => NI\181938c6\3c74e9a9\1	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => m\x00s\x00c\x00o\x00r\x00l\x00i\x00b\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => 4361 ValueName => ConfigMask	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => Z\x00A\x00P\x00-\x00-\x000\x000\x000\x000\x00-\x000\x000\x000\x000\x00\x00\x00 ValueName => ConfigString	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => MVID	SUCCESS	0x00000000
21:05:12,516	536	RegCloseKey	Handle => 0x00000154	SUCCESS	0x00000000
21:05:12,516	536	RegOpenKeyExW	Handle => 0x00000154 Registry => 0x00000158 SubKey => NI\181938c6\3c74e9a9\1	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 DataLength => 1024 ValueName => EvalationData Type => 1240984	FAILURE	0x00000002
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => 0 ValueName => Status	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => ILDependencies	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 DataLength => 1024 ValueName => NIDependencies Type => 1240984	FAILURE	0x00000002
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 DataLength => 1024 ValueName => MissingDependencies Type => 1240984	FAILURE	0x00000002
21:05:12,516	536	RegCloseKey	Handle => 0x00000154	SUCCESS	0x00000000
21:05:12,516	536	RegOpenKeyExW	Handle => 0x00000154 Registry => 0x00000158 SubKey => IL\7950e2c5\319545b3\1	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => m\x00s\x00c\x00o\x00r\x00l\x00i\x00b\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => 8198 ValueName => Status	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => s\x00o\x00r\x00t\x00k\x00e\x00y\x00.\x00n\x00l\x00p\x00|\x00s\x00o\x00r\x00t\x00t\x00b\x00l\x00s\x00.\x00n\x00l\x00p\x00|\x00b\x00i\x00g\x005\x00.\x00n\x00l\x00p\x00|\x00b\x00o\x00p\x00o\x00m\x00o\x00f\x00o\x00.\x00n\x00l\x00p\x00|\x00k\x00s\x00c\x00.\x00n\x00l\x00p\x00|\x00p\x00r\x00c\x00.\x00n\x00l\x00p\x00|\x00p\x00r\x00c\x00p\x00.\x00n\x00l\x00p\x00|\x00x\x00j\x00i\x00s\x00.\x00n\x00l\x00p\x00|\x00n\x00o\x00r\x00m\x00i\x00d\x00n\x00a\x00.\x00n\x00l\x00p\x00|\x00n\x00o\x00r\x00m\x00n\x00f\x00c\x00.\x00n\x00l\x00p\x00|\x00n\x00o\x00r\x00m\x00n\x00f\x00d\x00.\x00n\x00l\x00p\x00|\x00n\x00o\x00r\x00m\x00n\x00f\x00k\x00c\x00.\x00n\x00l\x00p\x00|\x00n\x00o\x00r\x00m\x00n\x00f\x00k\x00d\x00.\x00n\x00l\x00p\x00\x00\x00 ValueName => Modules	SUCCESS	0x00000000
21:05:12,516	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => SIG	SUCCESS	0x00000000
21:05:12,526	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:12,526	536	RegCloseKey	Handle => 0x00000154	SUCCESS	0x00000000
21:05:12,526	536	RegCreateKeyExW	Handle => 0x00000154 Access => 131097 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Fusion\GACChangeNotification\Default	SUCCESS	0x00000000
21:05:12,526	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => mscorlib,2.0.0.0,,b77a5c561934e089,x86	SUCCESS	0x00000000
21:05:12,546	536	LdrLoadDll	Flags => 1241188 BaseAddress => 0x790c0000 FileName => C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll	SUCCESS	0x00000000
21:05:12,566	536	LdrGetDllHandle	ModuleHandle => 0x79e70000 FileName => MSCORWKS.dll	SUCCESS	0x00000000
21:05:12,566	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => mscorjit.dll	FAILURE	3221225781	1 time
21:05:12,566	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => MSCORPE.dll	FAILURE	3221225781	1 time
21:05:12,596	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI	SUCCESS	4294967295
21:05:12,596	536	NtOpenMutant	Handle => 0x0012f948 MutexName => Global\CLR_CASOFF_MUTEX	FAILURE	3221225524
21:05:12,656	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001872f0
21:05:12,656	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001872f0
21:05:12,656	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001872f0
21:05:12,656	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001872f0
21:05:12,656	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr	SUCCESS	0x001872f0
21:05:12,666	536	LdrLoadDll	Flags => 1242116 BaseAddress => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ole32.dll	FAILURE	3221225781
21:05:12,666	536	LdrLoadDll	Flags => 1243392 BaseAddress => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
21:05:12,666	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:12,676	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll	FAILURE	3221225781	1 time
21:05:12,676	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => \xb8\xf4\xf5\x06\x9ft6\xccj\xef\xb9\xdd\xd5\xaa\xe8Z\x94\xfaHk\xf6\x7f\x9bPF\x9f\x8a \xdf\x11T\xe7\xa2 \xf9\x93b\xfa\\xbf@mo\xc1\x08\xb4\xd0\x82.\x01\x16G\x8a\x8e\xc8m\xf1\xe0`\xc9\xa8\xa8\x8c\xe6\xc5=W\xc9\x90\xc2e\xab\xa7u\xd97\xf7\x12\xa2\x88\xca\xf1,by\x0fv=\xc1m\xd2\x02\xf7\xf2\x96<\xa2o+\x9cu\x0fUc@-Ztn\x01\xe8\xdd\x91a\x04\xe3\xd3\xadDQ:\xd6\xf1\xdf\x98\eVF\xf0J\xda\xe26S\xf6&[B\x9a(\xff\x89\x93\xba\x93A\x85\xd8o\xc1\xe9\x95\x02\xfd\x15Ee\xd3f\x1ep\xd5\x19\x03%\xf1\x9dr\x16\xab\x9c\xaf\xf6\xfd\xc5MH\x89u\x89\xf3\xf1\xa3yX\x97\xd3M,\x13\x9cx\xf6v\xed\xfd\xc5\xb0\xa4\x1b\x06k\x95:\xfc\x95 \xa1\xccP\xe4L\x19\xb7p\x84\x94\x8a\x83!\x9d\x0b\xc9;b\xa2\x9a\xc6\x90\xe6\x12\x0fI\x07%\xca\xc4).\x0cnrZ\x1a_" \x0bM\xe1\xec(\xd5\xee\x91 IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(=dX\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,676	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => \xd0d,l\xe7\x07X\x99\x08\x0cv\x893\xa3\xf8(\x11\xcf\xbe\\xfc\xadr\x90\xcb\xe8\x91\xc0\xa2\x15\x14HD\x9f\xfd\xfa\xcb*\xf2}X\x14z\xcf\xec\xf9\xde\xe2\x14n\x9a\xf1\x11*If!\x84zv\xb8\xbb6\xa3\x07\xa7\xba\xb2\xea(\xedN\xee{+>\xfaa=\xd2&\xeas\x92\xdf#a T\xc2\xbfP\x8c\xeb\x98c\xebh \x02\x85\xc9\xd5\x88HGU\xe1\xda\xf8\xd85\x98\xe2RITo2\x1b%\x99\xcb8KqnVs\x93\xce\x9df\xa6\x18\xb1u1\xeb\x80\x1bM\xec\x9fMQ\x17\x1e+p-\xc5\xa8\x05Z$\xca\xd9\xdea \xf20\xa7\x80\x0f|\x94'^\xfb\xd3\xceP1?\xe9\xf3\x88\x94\xc6\xedkXJ!Z\xd9\xe5$\xad\x1a\x04\xb6\x0b\xe1zX?>x\xe1\xbc\xc9\x9fA\xbb\x9be<\x9b\x93\xe1\x99\x8c\x8e\xaf|\xd3\xf5\x1fF\xda@\xec{\xe2x\xaa\x9a\xf2u\x82\xa5\xaf\xcdy\x12\xd8L\x8fw]1-\xc7\x00\xb6 5OQ\xff\x9d\xee\x1d IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,686	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => EmGB{\xe9;\xb6\x06\xef\xdb\xd7\x97\xc4l\xe0\xa7\x06B/&a\xb6\x7f\x0f\xb0\x8c9Ce\xf5\xcb\xdd\xcc\x9c\xb7'\x08Ruk\xcd~W\xbb\x8d\xa1\xf5<b\xc3\xa6\xeb\x99]\xd6.J\xd5e\xf9t\x86\xdduy\xa6,\xccI\x0b\x8e\xab\x89\xd8p\xb4\xef\xc0\x18\xefJ\x89\x97\x13}y\xc9d\xec\xca\x8b\x98X\xf3;\xd7\xd1\xc5\x92\xce\x17 \xa1r\x7f\x16\xe923-\xc9\xf0s\xc6\xc1\xd2!4\x80\x05\xa7/2Ai\xbb\xfe2\xb5\x04\xa2 GH\xbbL\xee=\xa7\xcf\x10$\xc4\xca\xdbRUi\xfd\xe8\xef`\x87\xe61\xd9\xd9\xb0\xa3\xc9[`xy\x12S4O\x0f$A\xcd\x8f\x0c\xc8\xb9\x1e$\x1c\x15rL\xf2`\x93@\x9c\x7f\xef\xca\x7f\xa1\xb5\xf2Z\xbe\x99\xc9\xce\x81\xf8,\xd3\x8e\xa3@<\xf9\x8d\x1a\xf8S]\xc4*EaRI\xbc\xa42\x9f \x08lFU\x87\x04%\xf7\xa8'\xe0?\xc7\xf1\x11\xec\x93\xe4\x8d"5+\x02w\xbfQ\x06$\x07\xdf? IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,686	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => ~c}:\xfd\x18h*\xab\xc9\xb6\xf0\xfa\xe3\xef\xc9\x0c\xd7\x9b\x8d\xc1\x7f\xe6~5\xe9 3\x99\x02\xa2\xf5\x88P5< *?\xfa\x98\x12 \x8c\x85\x9b\xc7r\x8d\xb0\xc4\x0e\xb3\xd9mQb\x133\xa7w\xaa\xd6\x1dNk\xa6sAO.\x01\xd2\xe0%\xbdf\x8e^\xdd\xfe\xb0\xeb\xf4C\xc6nU\xd2\xce\x8a\xe92T\xc5\x15H+\x93\xc3\xfd\x19&OF\xa7S\xb7a\x9d\x85V+\x05,\xc4\xc0x\x86s\xd0l>BH\xf1\x9d"\xc6\xb8 \x875.\x012Q\x7fU\x1b\xdd\xd4#(\xac#\xc3\xe0\xce\xcb\xc4\x19\x08\xf3\xa4$:\x91\x0b\xfb\x14\xd8\x82\xe7\xb2\x14\xde\xc3\xf7h\xca\xc7\xab\xb9\x98\xf5\x12y\x84\xb2&\x14\xf0\xf5\xee"wb6\x91$\xac\xa5+lR\xaa\x9f\xf74#\xc2\x7f\x896\x10q@\x9f\xe1\xbbI\x07p<\xe1\\x1a\xae\xbc?\xd3\xbe\xd4\x12Ie\xee\xc4\xee\x07unRVgz\xf0%{\x04p/\x92{\xa3\xd7@&\xad\xdc\xbb\x9a\x1fY\xee IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,686	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => $n\xfb\x0b\x1d-\xfb*g#)@@5\xb9\x90Is5\x19\xd7\x80\xc5\xde\x8bw\xaa$\x9d\xa9\xce\x1d\x81k\xeaG\xabt\xd0m\x88\xd5y\xc6\xffrs\x01\xff;\x00\xa2\xe0\xed)\xff\x81D\\xf9+\xf7<\xef*\xd8\xe2?\x08\x81\x9e\x07I6\x08\x05\xb3:\x9b24*\xae\xc0\x8c\x8f\xdf0\x9b[\x91\x08\xa9a|B\x1e\x9a' 1x\x9065J\xc2t \xc4\xdc\xe5\xe4\xcd\xbc\x90\xdc\xd4\xe2\x1fv]\x87,V\xf5\x8a\xbd\xa4\x81\xf2a\x90\xde\xe1\x14\x9b\x07p\xabA\xc2{\xa5k}\xea\x8f\x130U\xdcc{\xa9O\xc5\xc1V$\\x0c\xe5\x10\x9byRy'\x04| \xf2\\xe0l\xf3M\xb9\x98\xb6\xec>1\xa7P\xefJzL\xf5Or\xa6\x8a\xb4\xf3\x0b\x13\xc9\xd4\xb0b\xeax\xa6\x81O\xa3\x02\x1e\x92C<N\x90\xf3\xa3\x9f\x1b\xcd\xab_\xf8U\x86\x94/ \xf1\x12L\xa3L}]H\xca\xe4(\x084\xcc\x873\xaa\xf6\xd6-\xe5 \x92\x99M\xcb\xfa IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,686	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => \xf5Lwc3'V\xb8Z\xe2\xd8x/h\xbd\xc7\xe8\x17:T\xdf]\xb5\xf8\xa1\xeb\x08\xe7W%\xeb?\xc5yb\xec\xb0\x9c\x93\xb4\x07\xb4#\x8fG\xacL\xeax\x89\x16\xc7\x1f\xf6\x0e\xbeTl\xf2\x0f\xc2\xe7\xd1} \xea\xe6\xd6\xa2}\xe1\xbd\xdd\x1fsP\xf5\x81m>-\x1d\xdc\xd0\x80J\x08w\xac\x0c\xabJ\xb0\xc8\xa9\xab|>\xa3?\xc5d\x16\x92=\x13\xb1M\xec\xe2\xad9?q\xfd\x8cj\x8c9\x13\x0f\x96R\xd5\xfb\xe0\x959_o\xb7\x03?\x9a\xd06\x87\xabEO\xde\xdb\xc7Q\xdc\xf9~\x15Or\xe2\xa2\xfe\xd5T\xc9\x9a\x0fF\x01\xcd\xb8\x99\xc4\xbb\xb6\xec\x1b"\xdc\x9a \x0b`\xa9\xcb\x89\x97\xd0\xab{\x89Aq\xfdk#U\x1b\xc0\xcd\x82\x05\x17\xc6\x91ZO\x11z\xcd\xca\x0e\xcf,\xda\xf92j\xfc\xde\xb8\x12Z\x1b\xd3\x1b&\xfak$\x8d~\xbf\xd2Lx\x0c6\x91z\x0c`S\x9d\x19\xba^E\x07\xc0=E\xb1\x91\xee\x10\xff\xb6\xedL\x83%v~\x86 IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,686	536	DeviceIoControl	DeviceHandle => 0x00000168 OutBuffer => \xb8\x88\x7f\xac\xe5\xc5\x97t\xe7\x83\xd4 \x18-\xb5*\xb8r\xec\x0e{\x12f\xf6`D\xa7\xb5\xect\xea\xb3\xfe*#5\x0f\x11\xde9k\x952\x97\xeb\x02\x83UJ\xb3\xf9\xa9'\x1b\xd73>\x10\xb8\xa2[\x9c\xfb\xe2,t\xf8P\xae\x83\xb8\x80\x8e\xefvI\xdd\xb7\x93`\x93\xf2\x84\xa4>\x18%\xe8\xd0B:\xd0*?\x80\x0e\xd2@\x81h\xe2\xaf\xa1M\x82F\x80\x06"\x91\x184\xcb\xe9t\xa2\xb9\xa9\x00(Y\xef\x9e\xbbcf\xee\xac\xb4t\xf2\xa5\xd5I{a\x8d\xe3u\xb5m3x\x9e\x8e\x05\xda\x838\x95&\xd0\x8f2\x80\xa3\xffqbk\x91L"U\xa8\x1b`\xe3X&\xb0\xb2\xd9\x19F\xd7XD\xea\xbc\x02\x8c'c\x19\x9e\x06g=\x03\xf4\xfei\x87\x0b\xb7\xaf\xaa-@+\x80/\x8d\x10\xbf\x82\xa7\x14\x1b\x7fO\xc9\xb1tt`\xf7\x03\xb9\x9a\xf9\xa4g\x8d\x951\xc1\x89\xb8az\xa7\xc8_\xafB\xc7\xf9\xdf\x0e\x96\xd9e\xb7\xd2Ge\xfc\xc4\xddR0\xc2\x81[ IoControlCode => 3735560 InBuffer => \xfa\xce\xe36\xfdKt\xff\xd6;\xbaN\xb5(\x1a\x8c\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb:\x88\x80\x9aI\xc2\xeb\x1d`X\x0cO\xd1\xe9\xe0'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000001
21:05:12,696	536	LdrLoadDll	Flags => 1241888 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll	SUCCESS	0x00000000
21:05:12,696	536	IsDebuggerPresent		FAILURE	0x00000000
21:05:12,696	536	LdrLoadDll	Flags => 1241708 BaseAddress => 0x5ad70000 FileName => uxtheme.dll	SUCCESS	0x00000000
21:05:12,696	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019
21:05:12,696	536	ZwMapViewOfSection	SectionOffset => 0x0012f154 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x00eb0000	SUCCESS	0x00000000
21:05:12,706	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	1 time
21:05:12,706	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:12,706	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => QueryActCtxW FunctionAddress => 0x7c81636b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:12,706	1080	LdrLoadDll	Flags => 15399608 BaseAddress => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
21:05:12,706	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoGetContextToken FunctionAddress => 0x77584e24 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:12,736	536	RegOpenKeyExW	Handle => 0x00000174 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework\Policy\AppPatch	SUCCESS	0x00000000
21:05:12,736	536	RegOpenKeyExW	Handle => 0x00000178 Registry => 0x00000174 SubKey => v4.0.30319.00000	SUCCESS	0x00000000
21:05:12,736	536	RegCloseKey	Handle => 0x00000174	SUCCESS	0x00000000
21:05:12,736	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000178 SubKey => mscorwks.dll	FAILURE	0x00000002
21:05:12,736	536	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
21:05:12,746	536	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
21:05:12,746	536	RegQueryValueExW	Handle => 0x00000178 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache	SUCCESS	0x00000000
21:05:12,746	536	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
21:05:12,746	536	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
21:05:12,746	536	RegSetValueExW	Handle => 0x00000178 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1	SUCCESS	0x00000000
21:05:12,746	536	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
21:05:12,756	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x0018f8c8
21:05:12,756	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x0018f8c8
21:05:12,756	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x0018f8c8
21:05:12,756	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x0018f8c8
21:05:12,766	536	RegOpenKeyExW	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32	SUCCESS	0x00000000
21:05:12,766	536	RegQueryValueExW	Handle => 0x00000178 Data => 18 ValueName => LatestIndex	SUCCESS	0x00000000
21:05:12,766	536	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
21:05:12,766	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000158 SubKey => NI\3897046b\4e120806	FAILURE	0x00000002
21:05:12,766	536	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000178	SUCCESS	0x00000000
21:05:12,766	536	NtQueryInformationFile	FileHandle => 0x00000178 FileInformation => \x00p\x01\x00\x00\x00\x00\x00\x00n\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:12,766	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000174 FileHandle => 0x00000178	SUCCESS	0x00000000
21:05:12,766	536	ZwMapViewOfSection	SectionOffset => 0x0012f4f8 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x00f00000	SUCCESS	0x00000000
21:05:12,776	536	LdrLoadDll	Flags => 1242172 BaseAddress => 0x77dd0000 FileName => AdvApi32.dll	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptAcquireContextA FunctionAddress => 0x77de791d ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptReleaseContext FunctionAddress => 0x77de7ece ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptCreateHash FunctionAddress => 0x77de9c51 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDestroyHash FunctionAddress => 0x77de9bac ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptHashData FunctionAddress => 0x77de9a7e ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptGetHashParam FunctionAddress => 0x77de9d94 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptImportKey FunctionAddress => 0x77dea1d1 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptExportKey FunctionAddress => 0x77e11b89 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,776	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptGenKey FunctionAddress => 0x77e117d9 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptGetKeyParam FunctionAddress => 0x77df1278 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDestroyKey FunctionAddress => 0x77de9e9c ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptVerifySignatureA FunctionAddress => 0x77dfc811 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptSignHashA FunctionAddress => 0x77e11f71 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptGetProvParam FunctionAddress => 0x77df1319 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptGetUserKey FunctionAddress => 0x77e11ab1 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptEnumProvidersA FunctionAddress => 0x77e113f1 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:12,786	536	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\StrongName	FAILURE	0x00000002
21:05:12,786	536	LdrLoadDll	Flags => 1241808 BaseAddress => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMetaDataInternalInterface FunctionAddress => 0x79008adb ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:12,786	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMetaDataInternalInterface_RetAddr FunctionAddress => 0x7900cd00 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:12,796	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMetaDataInternalInterface FunctionAddress => 0x603c0352 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:12,796	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMetaDataInternalInterface FunctionAddress => 0x79e960b0 ModuleHandle => 0x79e70000	SUCCESS	0x00000000
21:05:12,796	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.INI	SUCCESS	4294967295
21:05:12,806	536	FindFirstFileExW	FileName => C:/DOCUME~1	SUCCESS	0x0018db50
21:05:12,806	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW	SUCCESS	0x0018db50
21:05:12,806	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW/LOCALS~1	SUCCESS	0x0018db50
21:05:12,806	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW/LOCALS~1/Temp	SUCCESS	0x0018db50
21:05:12,806	536	RegOpenKeyExW	Handle => 0x00000174 Registry => 0x80000002 SubKey => Software\Microsoft\Fusion\PublisherPolicy\Default	SUCCESS	0x00000000
21:05:12,806	536	RegQueryValueExW	Handle => 0x00000174 Data => 1 ValueName => Latest	SUCCESS	0x00000000
21:05:12,816	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\pubpol1.dat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000017c	SUCCESS	0x00000000
21:05:12,816	536	RegQueryValueExW	Handle => 0x00000174 Data => ValueName => index1	SUCCESS	0x00000000
21:05:12,816	536	RegQueryValueExW	Handle => 0x00000174 Data => ValueName => LegacyPolicyTimeStamp	SUCCESS	0x00000000
21:05:12,816	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,816	536	NtReadFile	Buffer => <?xml version="1.0" encoding="UTF-8"?><!-- Please refer to machine.config.comments for a description and the default values of each configuration section. For a full documentation of the schema please refer to http://go.microsoft.com/ FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,816	536	NtReadFile	Buffer => Xml.Serialization.Configuration.SchemaImporterExtensionsSection, System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/> <section name="dateTimeSerialization" type="System.Xml.Serialization.Configuration.DateTimeSerializatio FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,816	536	NtReadFile	Buffer => b03f5f7f11d50a3a" allowDefinition="MachineToApplication"/> <section name="membership" type="System.Web.Configuration.MembershipSection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplicat FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,816	536	NtReadFile	Buffer => <section name="sqlCacheDependency" type="System.Web.Configuration.SqlCacheDependencySection, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication"/> </sectionGroup> </sectionGroup> FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,816	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000158 SubKey => NI\1c22df2f\52628d2e	FAILURE	0x00000002
21:05:12,836	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,846	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000184 FileHandle => 0x00000180	SUCCESS	0x00000000
21:05:12,846	536	ZwMapViewOfSection	SectionOffset => 0x0012dd40 SectionHandle => 0x00000184 ProcessHandle => 0xffffffff BaseAddress => 0x5e430000	SUCCESS	0x00000000
21:05:12,856	536	ZwMapViewOfSection	SectionOffset => 0x0012dd40 SectionHandle => 0x00000184 ProcessHandle => 0xffffffff BaseAddress => 0x00f00000	SUCCESS	0x40000003
21:05:12,916	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI	SUCCESS	4294967295
21:05:12,926	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000188	SUCCESS	0x00000000
21:05:12,926	536	NtQueryInformationFile	FileHandle => 0x00000180 FileInformation => P\x1a\x94\xea\xe5\x91\xcf\x01\xa0\xcc\x9e\xea\xe5\x91\xcf\x01\xe0\xaf\x98\xea\xe5\x91\xcf\x01\xe0\xaf\x98\xea\xe5\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@ \x00\x00\x00\x00\x00\x00@ \x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdbF\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xc8\x00\x00\x00\\x00W\x00	FAILURE	2147483653
21:05:12,926	536	NtQueryInformationFile	FileHandle => 0x00000188 FileInformation => P\x1a\x94\xea\xe5\x91\xcf\x01\xa0\xcc\x9e\xea\xe5\x91\xcf\x01\xe0\xaf\x98\xea\xe5\x91\xcf\x01\xe0\xaf\x98\xea\xe5\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@ \x00\x00\x00\x00\x00\x00@ \x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdbF\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xc8\x00\x00\x00\\x00W\x00	FAILURE	2147483653
21:05:12,926	536	LdrLoadDll	Flags => 1239608 BaseAddress => 0x5e430000 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll	SUCCESS	0x00000000
21:05:13,017	536	LdrLoadDll	Flags => 1240044 BaseAddress => 0x79060000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll	SUCCESS	0x00000000
21:05:13,017	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => getJit FunctionAddress => 0x790a6082 ModuleHandle => 0x79060000	SUCCESS	0x00000000
21:05:13,017	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:13,017	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsWow64Process FunctionAddress => 0x7c815229 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:13,027	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => NI\61e7e666\69db6748	SUCCESS	0x00000000
21:05:13,027	536	RegEnumKeyExW	Index => 0 Handle => 0x0000018c Name => 11 Class =>	SUCCESS	0x00000000
21:05:13,027	536	RegEnumKeyExW	Index => 1 Handle => 0x0000018c Name => 11 Class =>	FAILURE	0x00000103
21:05:13,027	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,027	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => NI\61e7e666\69db6748\11	SUCCESS	0x00000000
21:05:13,027	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00W\x00i\x00n\x00d\x00o\x00w\x00s\x00.\x00F\x00o\x00r\x00m\x00s\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,027	536	RegQueryValueExW	Handle => 0x0000018c Data => 4361 ValueName => ConfigMask	SUCCESS	0x00000000
21:05:13,027	536	RegQueryValueExW	Handle => 0x0000018c Data => Z\x00A\x00P\x00-\x00-\x000\x000\x000\x000\x00-\x000\x000\x000\x000\x00\x00\x00 ValueName => ConfigString	SUCCESS	0x00000000
21:05:13,027	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => MVID	SUCCESS	0x00000000
21:05:13,027	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,027	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => NI\61e7e666\69db6748\11	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => EvalationData Type => 1231684	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 0 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => ILDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => NIDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => MissingDependencies Type => 1231684	FAILURE	0x00000002
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\475dce40\2995e574\9	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\19ab8d57\291a02d0\7	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00X\x00m\x00l\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\2dd6ac50\3914f670\25	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => A\x00c\x00c\x00e\x00s\x00s\x00i\x00b\x00i\x00l\x00i\x00t\x00y\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\424bd4d8\67e63d5c\6	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\41c04c7e\4426ac2f\21	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00R\x00u\x00n\x00t\x00i\x00m\x00e\x00.\x00S\x00e\x00r\x00i\x00a\x00l\x00i\x00z\x00a\x00t\x00i\x00o\x00n\x00.\x00F\x00o\x00r\x00m\x00a\x00t\x00t\x00e\x00r\x00s\x00.\x00S\x00o\x00a\x00p\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\3ced59c5\7f729234\e	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00D\x00e\x00p\x00l\x00o\x00y\x00m\x00e\x00n\x00t\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\c991064\268e923b\24	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00W\x00i\x00n\x00d\x00o\x00w\x00s\x00.\x00F\x00o\x00r\x00m\x00s\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231608	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => NI\30bc7c4f\1d498232\8	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4361 ValueName => ConfigMask	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => Z\x00A\x00P\x00-\x00-\x000\x000\x000\x000\x00-\x000\x000\x000\x000\x00\x00\x00 ValueName => ConfigString	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => MVID	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => EvalationData Type => 1231492	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 0 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => ILDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => NIDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => MissingDependencies Type => 1231492	FAILURE	0x00000002
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\3f50fe4f\6e9ac653\8	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x007\x007\x00a\x005\x00c\x005\x006\x001\x009\x003\x004\x00e\x000\x008\x009\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231416	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => NI\3cca06a0\31de29a4\b	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00D\x00r\x00a\x00w\x00i\x00n\x00g\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4361 ValueName => ConfigMask	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => Z\x00A\x00P\x00-\x00-\x000\x000\x000\x000\x00-\x000\x000\x000\x000\x00\x00\x00 ValueName => ConfigString	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => MVID	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => EvalationData Type => 1231492	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 0 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => ILDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => NIDependencies	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => MissingDependencies Type => 1231492	FAILURE	0x00000002
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegOpenKeyExW	Handle => 0x0000018c Registry => 0x00000158 SubKey => IL\6dc7d4c0\3fcdfaca\10	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => S\x00y\x00s\x00t\x00e\x00m\x00.\x00D\x00r\x00a\x00w\x00i\x00n\x00g\x00,\x002\x00.\x000\x00.\x000\x00.\x000\x00,\x00,\x00b\x000\x003\x00f\x005\x00f\x007\x00f\x001\x001\x00d\x005\x000\x00a\x003\x00a\x00\x00\x00 ValueName => DisplayName	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => 4098 ValueName => Status	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c DataLength => 1024 ValueName => Modules Type => 1231416	FAILURE	0x00000002
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => SIG	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x0000018c Data => ValueName => LastModTime	SUCCESS	0x00000000
21:05:13,037	536	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System,2.0.0.0,,b77a5c561934e089,MSIL	SUCCESS	0x00000000
21:05:13,037	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Xml,2.0.0.0,,b77a5c561934e089,MSIL	SUCCESS	0x00000000
21:05:13,047	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,107	536	LdrLoadDll	Flags => 1231452 BaseAddress => 0x7a440000 FileName => C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\36dbfcf62e07d819b3de533898868ecf\System.ni.dll	SUCCESS	0x00000000
21:05:13,177	536	LdrLoadDll	Flags => 1231640 BaseAddress => 0x7ade0000 FileName => C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c91f68c2920882e02aec00eeabb6b415\System.Drawing.ni.dll	SUCCESS	0x00000000
21:05:13,187	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,187	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,187	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,187	536	RegQueryValueExW	Handle => 0x00000154 Data => ValueName => System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL	SUCCESS	0x00000000
21:05:13,227	536	LdrLoadDll	Flags => 1231828 BaseAddress => 0x7afd0000 FileName => C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0c70e5d82578be2f6c0dde89182261c5\System.Windows.Forms.ni.dll	SUCCESS	0x00000000
21:05:13,247	536	LdrGetDllHandle	ModuleHandle => 0x79e70000 FileName => MSCORWKS.dll	SUCCESS	0x00000000
21:05:13,247	536	LdrGetDllHandle	ModuleHandle => 0x79060000 FileName => mscorjit.dll	SUCCESS	0x00000000
21:05:13,247	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => MSCORPE.dll	FAILURE	3221225781	1 time
21:05:13,277	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI	SUCCESS	4294967295
21:05:13,277	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\.NETFramework\Policy\APTCA	FAILURE	0x00000002
21:05:13,287	536	LdrGetDllHandle	ModuleHandle => 0x79e70000 FileName => MSCORWKS.dll	SUCCESS	0x00000000
21:05:13,287	536	LdrGetDllHandle	ModuleHandle => 0x79060000 FileName => mscorjit.dll	SUCCESS	0x00000000
21:05:13,287	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => MSCORPE.dll	FAILURE	3221225781	1 time
21:05:13,297	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI	SUCCESS	4294967295
21:05:13,327	536	LdrGetDllHandle	ModuleHandle => 0x79e70000 FileName => MSCORWKS.dll	SUCCESS	0x00000000
21:05:13,327	536	LdrGetDllHandle	ModuleHandle => 0x79060000 FileName => mscorjit.dll	SUCCESS	0x00000000
21:05:13,327	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => MSCORPE.dll	FAILURE	3221225781	1 time
21:05:13,407	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI	SUCCESS	4294967295
21:05:13,597	536	LdrLoadDll	Flags => 1236032 BaseAddress => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VERSION.dll	FAILURE	3221225781
21:05:13,597	536	LdrLoadDll	Flags => 1237308 BaseAddress => 0x77c00000 FileName => VERSION.dll	SUCCESS	0x00000000
21:05:13,597	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileVersionInfoSizeW FunctionAddress => 0x77c0138c ModuleHandle => 0x77c00000	SUCCESS	0x00000000
21:05:13,597	536	LdrGetDllHandle	ModuleHandle => 0x5e430000 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll	SUCCESS	0x00000000
21:05:13,597	536	LdrLoadDll	Flags => 1237412 BaseAddress => 0x5e430000 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll	SUCCESS	0x00000000
21:05:13,607	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileVersionInfoW FunctionAddress => 0x77c0166f ModuleHandle => 0x77c00000	SUCCESS	0x00000000
21:05:13,607	536	LdrGetDllHandle	ModuleHandle => 0x5e430000 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll	SUCCESS	0x00000000
21:05:13,607	536	LdrLoadDll	Flags => 1235448 BaseAddress => 0x5e430000 FileName => C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll	SUCCESS	0x00000000
21:05:13,607	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VerQueryValueW FunctionAddress => 0x77c01805 ModuleHandle => 0x77c00000	SUCCESS	0x00000000
21:05:13,647	536	LdrLoadDll	Flags => 1236652 BaseAddress => 0x7e410000 FileName => user32.dll	SUCCESS	0x00000000
21:05:13,647	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterWindowMessage FunctionAddress => 0x7b4a1d53 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:13,647	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterWindowMessageW FunctionAddress => 0x7e41af34 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:13,688	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x00ff0000	SUCCESS	0x00000000	1 time
21:05:14,158	536	LdrLoadDll	Flags => 1237608 BaseAddress => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:14,158	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetVersionEx FunctionAddress => 0x7912c451 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,158	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetVersionExW FunctionAddress => 0x7c80aef5 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,158	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,158	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,158	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcessW FunctionAddress => 0x0012e9f1 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,158	536	LdrLoadDll	Flags => 1237560 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
21:05:14,168	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcessToken FunctionAddress => 0x77dd797b ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:14,168	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcessTokenW FunctionAddress => 0x0012e9f1 ModuleHandle => 0x77dd0000	FAILURE	3221225785
21:05:14,198	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,198	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentThread FunctionAddress => 0x7c80997b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,198	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DuplicateHandle FunctionAddress => 0x7c80de8e ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,198	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentThreadId FunctionAddress => 0x7c8097b8 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,198	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemMetrics FunctionAddress => 0x7e418f9c ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,198	536	GetSystemMetrics	SystemMetricIndex => 75	SUCCESS	0x00000001
21:05:14,228	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetVersionEx FunctionAddress => 0x7912c451 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetVersionExW FunctionAddress => 0x7c80aef5 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrlen FunctionAddress => 0x7c80be46 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrlenW FunctionAddress => 0x7c809a99 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandle FunctionAddress => 0x7b4a1e72 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleW FunctionAddress => 0x7c80e4cd ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,238	536	LdrGetDllHandle	ModuleHandle => 0x7e410000 FileName => user32.dll	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DefWindowProcW FunctionAddress => 0x7e428d20 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,238	536	LdrLoadDll	Flags => 1237232 BaseAddress => 0x77f10000 FileName => gdi32.dll	SUCCESS	0x00000000
21:05:14,238	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStockObject FunctionAddress => 0x77f161c1 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:14,258	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:14,258	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserDefaultUILanguage FunctionAddress => 0x7c813100 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,268	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterClass FunctionAddress => 0x7b4a1ed3 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,268	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterClassW FunctionAddress => 0x7e41a39a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateWindowEx FunctionAddress => 0x7b4a1efb ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateWindowExW FunctionAddress => 0x7e42d0a3 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLong FunctionAddress => 0x7b4a1f30 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLongW FunctionAddress => 0x7e42c2bb ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowLong FunctionAddress => 0x7b4a1f57 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowLongW FunctionAddress => 0x7e4188a6 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,278	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCloseKey FunctionAddress => 0x77dd6c17 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:14,288	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\system32\l_intl.nls DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000194	SUCCESS	0x00000000
21:05:14,288	536	NtQueryInformationFile	FileHandle => 0x00000194 FileInformation => \x00 \x00\x00\x00\x00\x00\x00\x86\x1b\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:14,288	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000198 FileHandle => 0x00000194	SUCCESS	0x00000000
21:05:14,288	536	ZwMapViewOfSection	SectionOffset => 0x0012de64 SectionHandle => 0x00000198 ProcessHandle => 0xffffffff BaseAddress => 0x00ff0000	SUCCESS	0x00000000
21:05:14,298	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyEx FunctionAddress => 0x7912c807 ModuleHandle => 0x77dd0000	FAILURE	3221225785
21:05:14,298	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyExW FunctionAddress => 0x77dd6a9f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:14,298	536	RegOpenKeyExW	Handle => 0x00000198 Registry => 0x80000002 SubKey => Software\Microsoft\.NETFramework	SUCCESS	0x00000000
21:05:14,298	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueEx FunctionAddress => 0x7912c832 ModuleHandle => 0x77dd0000	FAILURE	3221225785
21:05:14,298	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueExW FunctionAddress => 0x77dd6fef ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
21:05:14,298	536	RegQueryValueExW	Handle => 0x00000198 DataLength => 0 ValueName => DbgJITDebugLaunchSetting Type => 0	FAILURE	0x00000002
21:05:14,298	536	RegQueryValueExW	Handle => 0x00000198 DataLength => 0 ValueName => DbgManagedDebugger Type => 0	FAILURE	0x00000002
21:05:14,298	536	RegCloseKey	Handle => 0x00000198	SUCCESS	0x00000000
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLong FunctionAddress => 0x7b4a1f30 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLongW FunctionAddress => 0x7e42c2bb ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CallWindowProc FunctionAddress => 0x7b4a1f95 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CallWindowProcW FunctionAddress => 0x7e42a01e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClientRect FunctionAddress => 0x7e42908e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,308	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowRect FunctionAddress => 0x7e4290b4 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,318	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetParent FunctionAddress => 0x7e42910f ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:14,348	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000158 SubKey => NI\432ba598\3d75b7fc	FAILURE	0x00000002
21:05:14,358	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000198	SUCCESS	0x00000000
21:05:14,358	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000194 FileHandle => 0x00000198	SUCCESS	0x00000000
21:05:14,368	536	ZwMapViewOfSection	SectionOffset => 0x0012d98c SectionHandle => 0x00000194 ProcessHandle => 0xffffffff BaseAddress => 0x67770000	SUCCESS	0x00000000
21:05:14,368	536	ZwMapViewOfSection	SectionOffset => 0x0012d98c SectionHandle => 0x00000194 ProcessHandle => 0xffffffff BaseAddress => 0x01000000	SUCCESS	0x40000003
21:05:14,389	536	FindFirstFileExW	FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI	SUCCESS	4294967295
21:05:14,389	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000019c	SUCCESS	0x00000000
21:05:14,389	536	NtQueryInformationFile	FileHandle => 0x00000198 FileInformation => \xe0\xf9\xee\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x90\x04\x00\x00\x00\x00\x00\x00\x90\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01G\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd0\x00\x00\x00\\x00W\x00	FAILURE	2147483653
21:05:14,389	536	NtQueryInformationFile	FileHandle => 0x0000019c FileInformation => \xe0\xf9\xee\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01\x10\x81\xf0\xeb\xe5\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x90\x04\x00\x00\x00\x00\x00\x00\x90\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01G\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd0\x00\x00\x00\\x00W\x00	FAILURE	2147483653
21:05:14,399	536	LdrLoadDll	Flags => 1238660 BaseAddress => 0x67770000 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll	SUCCESS	0x00000000
21:05:14,779	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01050000	SUCCESS	0x00000000
21:05:14,979	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFullPathName FunctionAddress => 0x7912c48f ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,979	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFullPathNameW FunctionAddress => 0x7c80b8e2 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,989	536	LdrLoadDll	Flags => 1238660 BaseAddress => 0x00000000 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll	FAILURE	3221225781
21:05:14,989	536	LdrLoadDll	Flags => 1238660 BaseAddress => 0x5ad70000 FileName => uxtheme.dll	SUCCESS	0x00000000
21:05:14,989	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsAppThemed FunctionAddress => 0x5ad78b4d ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:14,989	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsAppThemedW FunctionAddress => 0x0012ee01 ModuleHandle => 0x5ad70000	FAILURE	3221225785
21:05:14,989	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateActCtx FunctionAddress => 0x7b4a26d7 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:14,989	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateActCtxA FunctionAddress => 0x7c86c785 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:14,989	536	NtOpenFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll DesiredAccess => 0x001200a9 FileHandle => 0x0000019c	SUCCESS	0x00000000
21:05:14,999	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x00000004 SectionHandle => 0x000001a0 FileHandle => 0x0000019c	SUCCESS	0x00000000
21:05:14,999	536	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x000001a0 ProcessHandle => 0xffffffff BaseAddress => 0x03510000	SUCCESS	0x00000000
21:05:15,009	536	NtOpenFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Manifest DesiredAccess => 0x001200a9 FileHandle => 0x00000000	FAILURE	3221225524
21:05:15,029	536	NtOpenFile	ShareAccess => 1 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config DesiredAccess => 0x001200a9 FileHandle => 0x00000000	FAILURE	3221225524
21:05:15,230	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01060000	SUCCESS	0x00000000
21:05:15,250	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01070000	SUCCESS	0x00000000
21:05:15,280	536	VirtualProtectEx	Protection => 0x00000040 ProcessHandle => 0xffffffff Address => 0x79e75af0 Size => 0x0000000a	SUCCESS	0x00000001
21:05:15,290	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AdjustWindowRectEx FunctionAddress => 0x7e42e7ea ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,330	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a6ce0
21:05:15,330	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001a6ce0
21:05:15,330	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001a6ce0
21:05:15,330	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001a6ce0
21:05:15,390	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a6ce0
21:05:15,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001a6ce0
21:05:15,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001a6ce0
21:05:15,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001a6ce0
21:05:15,540	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01070000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemDefaultLCID FunctionAddress => 0x7c80bfcd ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemDefaultLCIDW FunctionAddress => 0x0012e811 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStockObject FunctionAddress => 0x77f161c1 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetObject FunctionAddress => 0x7ae7ad53 ModuleHandle => 0x77f10000	FAILURE	3221225785
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetObjectW FunctionAddress => 0x77f183b3 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetDC FunctionAddress => 0x7e4186c7 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcessId FunctionAddress => 0x7c8099b0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,580	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcessIdW FunctionAddress => 0x0012de41 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FindAtom FunctionAddress => 0x7ae7adf7 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => FindAtomW FunctionAddress => 0x7c82f817 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AddAtom FunctionAddress => 0x7ae7ae0f ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => AddAtomW FunctionAddress => 0x7c8326d9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,590	536	LdrLoadDll	Flags => 1234596 BaseAddress => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryShim FunctionAddress => 0x79003180 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryShim_RetAddr FunctionAddress => 0x7900caf0 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:15,590	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryShim FunctionAddress => 0x603bf2aa ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:15,590	536	LdrLoadDll	Flags => 1236556 BaseAddress => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll	FAILURE	3221225781
21:05:15,750	536	LdrLoadDll	Flags => 1234600 BaseAddress => 0x4ec50000 FileName => gdiplus.dll	SUCCESS	0x00000000
21:05:15,750	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdiplusStartup FunctionAddress => 0x4ec71895 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsProcessorFeaturePresent FunctionAddress => 0x7c80aeba ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InterlockedCompareExchange FunctionAddress => 0x7c809832 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetDllHandle	ModuleHandle => 0x7e410000 FileName => user32.dll	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowInfo FunctionAddress => 0x7e42c49c ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetAncestor FunctionAddress => 0x7e42af79 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMonitorInfoA FunctionAddress => 0x7e42a84a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EnumDisplayMonitors FunctionAddress => 0x7e42a77b ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EnumDisplayDevicesA FunctionAddress => 0x7e428a74 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWinEventHook FunctionAddress => 0x7e4317f7 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnhookWinEvent FunctionAddress => 0x7e4318ac ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,771	536	GetSystemMetrics	SystemMetricIndex => 4096	SUCCESS	0x00000000
21:05:15,831	536	GetSystemMetrics	SystemMetricIndex => 78	SUCCESS	0x00000320
21:05:15,831	536	GetSystemMetrics	SystemMetricIndex => 79	SUCCESS	0x00000258
21:05:15,831	536	LdrGetDllHandle	ModuleHandle => 0x77f10000 FileName => gdi32.dll	SUCCESS	0x00000000
21:05:15,831	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ExtTextOutW FunctionAddress => 0x77f18086 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:15,831	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdiIsMetaPrintDC FunctionAddress => 0x77f2380b ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:15,871	536	CreateThread	ThreadId => 1036 StartRoutine => 0x4ec672b0 Parameter => 0x00000000 CreationFlags => 0	SUCCESS	0x000001a4
21:05:15,871	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipCreateFontFromLogfontW FunctionAddress => 0x4eca9384 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,871	1036	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,891	536	RegOpenKeyExW	Handle => 0x000001b8 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts	SUCCESS	0x00000000
21:05:15,891	536	RegQueryInfoKeyA	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 70 MaxSubKeyLength => 0 KeyHandle => 0x000001b8 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
21:05:15,891	536	RegCloseKey	Handle => 0x000001b8	SUCCESS	0x00000000
21:05:15,891	536	RegCreateKeyExW	Handle => 0x000001b8 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Microsoft\GDIPlus	SUCCESS	0x00000000
21:05:15,901	536	RegQueryValueExW	Handle => 0x000001b8 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => FontCachePath	SUCCESS	0x00000000
21:05:15,901	536	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:15,901	536	RegCloseKey	Handle => 0x000001b8	SUCCESS	0x00000000
21:05:15,901	536	NtQueryInformationFile	FileHandle => 0x000001bc FileInformation => \x00@\x00\x00\x00\x00\x00\x00(0\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,901	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000001b8 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:15,901	536	ZwMapViewOfSection	SectionOffset => 0x0012e284 SectionHandle => 0x000001b8 ProcessHandle => 0xffffffff BaseAddress => 0x011c0000	SUCCESS	0x00000000
21:05:15,931	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink	FAILURE	0x00000002
21:05:15,931	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => EUDC\1252	FAILURE	0x00000002
21:05:15,931	536	RegOpenKeyExW	Handle => 0x000001b4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes	SUCCESS	0x00000000
21:05:15,931	536	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 21 MaxSubKeyLength => 0 KeyHandle => 0x000001b4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 0 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00,\x002\x003\x008\x00\x00\x00 ValueName => Arial CE,238	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 1 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00,\x002\x000\x004\x00\x00\x00 ValueName => Arial CYR,204	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 2 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00,\x001\x006\x001\x00\x00\x00 ValueName => Arial Greek,161	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 3 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00,\x001\x006\x002\x00\x00\x00 ValueName => Arial TUR,162	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 4 Handle => 0x000001b4 Data => C\x00o\x00u\x00r\x00i\x00e\x00r\x00 \x00N\x00e\x00w\x00,\x002\x003\x008\x00\x00\x00 ValueName => Courier New CE,238	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 5 Handle => 0x000001b4 Data => C\x00o\x00u\x00r\x00i\x00e\x00r\x00 \x00N\x00e\x00w\x00,\x002\x000\x004\x00\x00\x00 ValueName => Courier New CYR,204	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 6 Handle => 0x000001b4 Data => C\x00o\x00u\x00r\x00i\x00e\x00r\x00 \x00N\x00e\x00w\x00,\x001\x006\x001\x00\x00\x00 ValueName => Courier New Greek,161	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 7 Handle => 0x000001b4 Data => C\x00o\x00u\x00r\x00i\x00e\x00r\x00 \x00N\x00e\x00w\x00,\x001\x006\x002\x00\x00\x00 ValueName => Courier New TUR,162	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 8 Handle => 0x000001b4 Data => M\x00S\x00 \x00S\x00a\x00n\x00s\x00 \x00S\x00e\x00r\x00i\x00f\x00\x00\x00 ValueName => Helv	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 9 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00\x00\x00 ValueName => Helvetica	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 10 Handle => 0x000001b4 Data => T\x00a\x00h\x00o\x00m\x00a\x00\x00\x00 ValueName => MS Shell Dlg 2	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 11 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00\x00\x00 ValueName => Times	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 12 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00,\x002\x003\x008\x00\x00\x00 ValueName => Times New Roman CE,238	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 13 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00,\x002\x000\x004\x00\x00\x00 ValueName => Times New Roman CYR,204	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 14 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00,\x001\x006\x001\x00\x00\x00 ValueName => Times New Roman Greek,161	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 15 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00,\x001\x006\x002\x00\x00\x00 ValueName => Times New Roman TUR,162	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 16 Handle => 0x000001b4 Data => M\x00S\x00 \x00S\x00e\x00r\x00i\x00f\x00\x00\x00 ValueName => Tms Rmn	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 17 Handle => 0x000001b4 Data => A\x00r\x00i\x00a\x00l\x00,\x001\x008\x006\x00\x00\x00 ValueName => Arial Baltic,186	SUCCESS	0x00000000
21:05:15,931	536	RegEnumValueW	Index => 18 Handle => 0x000001b4 Data => C\x00o\x00u\x00r\x00i\x00e\x00r\x00 \x00N\x00e\x00w\x00,\x001\x008\x006\x00\x00\x00 ValueName => Courier New Baltic,186	SUCCESS	0x00000000
21:05:15,941	536	RegEnumValueW	Index => 19 Handle => 0x000001b4 Data => T\x00i\x00m\x00e\x00s\x00 \x00N\x00e\x00w\x00 \x00R\x00o\x00m\x00a\x00n\x00,\x001\x008\x006\x00\x00\x00 ValueName => Times New Roman Baltic,186	SUCCESS	0x00000000
21:05:15,941	536	RegEnumValueW	Index => 20 Handle => 0x000001b4 Data => M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00 \x00S\x00a\x00n\x00s\x00 \x00S\x00e\x00r\x00i\x00f\x00\x00\x00 ValueName => MS Shell Dlg	SUCCESS	0x00000000
21:05:15,941	536	RegEnumValueW	Index => 21 Handle => 0x000001b4 DataLength => 260 ValueName => MS Shell Dlg Type => 1238632	FAILURE	0x00000103
21:05:15,941	536	RegCloseKey	Handle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\FONTS\MICROSS.TTF DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\x10\x07\x00\x00\x00\x00\x00h\x0b\x07\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\xa0\xa1\x10'\x9e\xc8\x01\xb0f'2\xf2\x91\xcf\x01\x00\xa0\xa1\x10'\x9e\xc8\x01\xf0k\xd9DoI\xcd\x01 \x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\FONTS\MICROSS.TTF DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\xa0\xa1\x10'\x9e\xc8\x01\xb0f'2\xf2\x91\xcf\x01\x00\xa0\xa1\x10'\x9e\xc8\x01\xf0k\xd9DoI\xcd\x01 \x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\x10\x07\x00\x00\x00\x00\x00h\x0b\x07\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000001bc FileHandle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	ZwMapViewOfSection	SectionOffset => 0x0012e738 SectionHandle => 0x000001bc ProcessHandle => 0xffffffff BaseAddress => 0x011c0000	SUCCESS	0x00000000
21:05:15,941	536	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\FONTS\MICROSS.TTF DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\xa0\xa1\x10'\x9e\xc8\x01\xb0f'2\xf2\x91\xcf\x01\x00\xa0\xa1\x10'\x9e\xc8\x01\xf0k\xd9DoI\xcd\x01 \x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtQueryInformationFile	FileHandle => 0x000001b4 FileInformation => \x00\x10\x07\x00\x00\x00\x00\x00h\x0b\x07\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:15,941	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000001bc FileHandle => 0x000001b4	SUCCESS	0x00000000
21:05:15,941	536	ZwMapViewOfSection	SectionOffset => 0x0012e6f0 SectionHandle => 0x000001bc ProcessHandle => 0xffffffff BaseAddress => 0x011c0000	SUCCESS	0x00000000
21:05:15,941	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RI2 FunctionAddress => 0x79002167 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RI2_RetAddr FunctionAddress => 0x7900cdc8 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RI2 FunctionAddress => 0x603bec66 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RU1 FunctionAddress => 0x790020f5 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RU1_RetAddr FunctionAddress => 0x7900cd70 ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_RU1 FunctionAddress => 0x603bec79 ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetFontUnit FunctionAddress => 0x4eca5745 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetFontSize FunctionAddress => 0x4eca56d9 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetFontStyle FunctionAddress => 0x4eca5892 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetFamily FunctionAddress => 0x4eca5826 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReleaseDC FunctionAddress => 0x7e41869d ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipCreateFromHDC FunctionAddress => 0x4ec58100 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetDpiY FunctionAddress => 0x4eca68f3 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetFontHeight FunctionAddress => 0x4eca7cb7 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetEmHeight FunctionAddress => 0x4ecaacec ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetLineSpacing FunctionAddress => 0x4ecaad7f ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipDeleteGraphics FunctionAddress => 0x4ec52f4f ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipCreateFont FunctionAddress => 0x4ec618d8 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,951	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipDeleteFont FunctionAddress => 0x4ec615e3 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:15,971	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:15,971	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcessWindowStation FunctionAddress => 0x7e419195 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserObjectInformation FunctionAddress => 0x7a777327 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserObjectInformationA FunctionAddress => 0x7e431300 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetConsoleCtrlHandler FunctionAddress => 0x7c81b2ab ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetConsoleCtrlHandlerW FunctionAddress => 0x0012df21 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,971	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandle FunctionAddress => 0x7a777391 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleW FunctionAddress => 0x7c80e4cd ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClassInfo FunctionAddress => 0x7a7773b3 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClassInfoW FunctionAddress => 0x7e42e81e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterClass FunctionAddress => 0x7a7773d4 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegisterClassW FunctionAddress => 0x7e41a39a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateWindowEx FunctionAddress => 0x7a7773fb ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateWindowExW FunctionAddress => 0x7e42d0a3 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DefWindowProc FunctionAddress => 0x7a777430 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DefWindowProcW FunctionAddress => 0x7e428d20 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetThemeAppProperties FunctionAddress => 0x5ad8c261 ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetThemeAppPropertiesW FunctionAddress => 0x0012e861 ModuleHandle => 0x5ad70000	FAILURE	3221225785
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenThemeData FunctionAddress => 0x5ad773b8 ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:15,981	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenThemeDataW FunctionAddress => 0x0012e841 ModuleHandle => 0x5ad70000	FAILURE	3221225785
21:05:15,981	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:15,991	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,031	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:16,031	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,031	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSysColor FunctionAddress => 0x7e418e78 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,031	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSysColorW FunctionAddress => 0x0012e841 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,031	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:16,031	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,051	536	LdrLoadDll	Flags => 1240256 BaseAddress => 0x77120000 FileName => oleaut32	SUCCESS	0x00000000
21:05:16,051	536	LdrLoadDll	Flags => 1238884 BaseAddress => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll	FAILURE	3221225781
21:05:16,051	536	LdrLoadDll	Flags => 1240160 BaseAddress => 0x77120000 FileName => OLEAUT32.dll	SUCCESS	0x00000000
21:05:16,051	536	LdrGetProcedureAddress	Ordinal => 204 FunctionName => FunctionAddress => 0x771526f5 ModuleHandle => 0x77120000	SUCCESS	0x00000000
21:05:16,091	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:16,091	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 5	SUCCESS	0x00000001
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 6	SUCCESS	0x00000001
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 59	SUCCESS	0x0000032c
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 60	SUCCESS	0x00000264
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 34	SUCCESS	0x0000007b
21:05:16,101	536	GetSystemMetrics	SystemMetricIndex => 35	SUCCESS	0x00000022
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateCompatibleDC FunctionAddress => 0x77f15fe0 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetLogFontW FunctionAddress => 0x4eca5f2b ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_WU1 FunctionAddress => 0x79002135 ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_WU1_RetAddr FunctionAddress => 0x7900ce1c ModuleHandle => 0x603b0000	FAILURE	3221225785
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ND_WU1 FunctionAddress => 0x603bec8c ModuleHandle => 0x603b0000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFontIndirect FunctionAddress => 0x7ae7b09b ModuleHandle => 0x77f10000	FAILURE	3221225785
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFontIndirectW FunctionAddress => 0x77f1938f ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SelectObject FunctionAddress => 0x77f15b70 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTextMetricsW FunctionAddress => 0x77f17db9 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTextExtentPoint32W FunctionAddress => 0x77f17f9d ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteDC FunctionAddress => 0x77f16e5f ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,111	536	GetSystemMetrics	SystemMetricIndex => 34	SUCCESS	0x0000007b
21:05:16,111	536	GetSystemMetrics	SystemMetricIndex => 35	SUCCESS	0x00000022
21:05:16,131	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentActCtx FunctionAddress => 0x7c830099 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,131	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ActivateActCtx FunctionAddress => 0x7c80a6d4 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,131	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	2 times
21:05:16,131	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowText FunctionAddress => 0x7b4a2126 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,131	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowTextW FunctionAddress => 0x7e42960e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,151	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetLayeredWindowAttributes FunctionAddress => 0x7e42ce12 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,151	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStartupInfo FunctionAddress => 0x7b4a2147 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:16,151	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetStartupInfoW FunctionAddress => 0x7c801e54 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,171	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemMetrics FunctionAddress => 0x7e418f9c ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,171	536	GetSystemMetrics	SystemMetricIndex => 11	SUCCESS	0x00000020
21:05:16,171	536	GetSystemMetrics	SystemMetricIndex => 12	SUCCESS	0x00000020
21:05:16,171	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetDeviceCaps FunctionAddress => 0x77f15a69 ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:16,171	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateIconFromResourceEx FunctionAddress => 0x7e41d354 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,171	536	GetSystemMetrics	SystemMetricIndex => 49	SUCCESS	0x00000010
21:05:16,171	536	GetSystemMetrics	SystemMetricIndex => 50	SUCCESS	0x00000010
21:05:16,181	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessage FunctionAddress => 0x7b4a2166 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,181	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessageW FunctionAddress => 0x7e42929a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,181	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	7 times
21:05:16,181	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemMenu FunctionAddress => 0x7e42b222 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,191	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowPlacement FunctionAddress => 0x7e4303c7 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,191	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EnableMenuItem FunctionAddress => 0x7e42d2c4 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,191	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClientRect FunctionAddress => 0x7e42908e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,191	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessage FunctionAddress => 0x7b4a2166 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,191	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessageW FunctionAddress => 0x7e42929a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,191	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	1 time
21:05:16,201	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowTextLength FunctionAddress => 0x7b4a21e8 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,201	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowTextLengthW FunctionAddress => 0x7e427836 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,201	536	GetSystemMetrics	SystemMetricIndex => 42	SUCCESS	0x00000000
21:05:16,201	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowText FunctionAddress => 0x7b4a21fc ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,201	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindowTextW FunctionAddress => 0x7e42a5cd ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,201	536	GetSystemMetrics	SystemMetricIndex => 42	SUCCESS	0x00000000
21:05:16,201	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	15 times
21:05:16,201	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowPos FunctionAddress => 0x7e4299f3 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	GetSystemMetrics	SystemMetricIndex => 31	SUCCESS	0x00000019	7 times
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RedrawWindow FunctionAddress => 0x7e429944 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ShowWindow FunctionAddress => 0x7e42af56 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetWindow FunctionAddress => 0x7e429655 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MapWindowPoints FunctionAddress => 0x7e429507 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClassInfo FunctionAddress => 0x7b4a2293 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetClassInfoW FunctionAddress => 0x7e42e81e ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,211	536	LdrLoadDll	Flags => 1237356 BaseAddress => 0x5ad70000 FileName => UxTheme.dll	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenThemeData FunctionAddress => 0x5ad773b8 ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessage FunctionAddress => 0x7b4a2166 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:16,211	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SendMessageW FunctionAddress => 0x7e42929a ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:16,221	536	LdrLoadDll	Flags => 1237520 BaseAddress => 0x00000000 FileName => C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll	FAILURE	3221225781
21:05:16,221	536	LdrLoadDll	Flags => 1237520 BaseAddress => 0x773d0000 FileName => comctl32.dll	SUCCESS	0x00000000
21:05:16,221	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InitCommonControlsEx FunctionAddress => 0x773d4088 ModuleHandle => 0x773d0000	SUCCESS	0x00000000
21:05:16,221	536	GetSystemMetrics	SystemMetricIndex => 46	SUCCESS	0x00000002
21:05:16,221	536	GetSystemMetrics	SystemMetricIndex => 45	SUCCESS	0x00000002
21:05:16,221	536	GetSystemMetrics	SystemMetricIndex => 46	SUCCESS	0x00000002
21:05:16,221	536	GetSystemMetrics	SystemMetricIndex => 45	SUCCESS	0x00000002
21:05:16,221	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EnableThemeDialogTexture FunctionAddress => 0x5ad7b45b ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:16,231	536	GetSystemMetrics	SystemMetricIndex => 42	SUCCESS	0x00000000
21:05:16,261	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLongPathName FunctionAddress => 0x7912d194 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:16,261	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLongPathNameW FunctionAddress => 0x7c8133e3 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,261	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x00190c08
21:05:16,261	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW	SUCCESS	0x00190c08
21:05:16,261	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW\LOCALS~1	SUCCESS	0x00190c08
21:05:16,271	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetErrorMode FunctionAddress => 0x7c80ac9f ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,271	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFile FunctionAddress => 0x7912cf70 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:16,271	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFileW FunctionAddress => 0x7c8107f0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,271	536	NtCreateFile	ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\phphotoset.scr DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,271	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileType FunctionAddress => 0x7c810ee1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,271	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReadFile FunctionAddress => 0x7c801812 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,271	536	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00\xe2 \xbdS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0e\x01\x0b\x01\x06\x00\x00"\x01\x00\x00H\x00\x00\x00\x00\x00\x00\xbeA\x01\x00\x00 \x00\x00\x00`\x01\x00\x00\x00@\x00\x00 \x00\x00\x00\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => \xfa\x02\x8c\x08\x00\x00\x1b:\x10\x00\x00\x00(\x04\x00\x00+ 8\x08\x00\x00\x008\x03\x00\x00\x00\x02 \x00\x06*\x00\x00\x00\x130\x03\x00\x1d\x00\x00\x00\x0c\x00\x00\x11+\x08(7B\x006\x14P&\x16-\xfa\x03\x12\x00\xfe\x15\x08\x00\x00\x1b\x06\x81\x08\x00\x00\x1b*\x00\x00\x00f+\x08(\xe0\x87\x02/\x14P&\x16-\xfa(\xb1\x00\x00\x06\x02(+\x00\x00 *\x00\x00b+\x08(\x9f=[S\x14P&\x16-\xfa\x00\xfe \x00\x00(<\x00\x00 *\x00\x00\x00n+\x08(\xc2\xa0kE\x14P&\x16-\xfa\xfe \x00\x00\xfe \x01\x00(=\x00\x00 *>+\x08(\x04'\x18F\x14P&\x16-\xfa\x17*>+\x08(\x99\xc6XI\x14P&\x16-\xfa\x16*^+\x08(Z*Rg\x14P&\x16-\xfa\xfe \x00\x00(;\x00\x00 *b+\x08(\xa3\xd22^\x14P&\x16-\xfa\x00\xfe \x00\x00(.\x00\x00 *\x00\x00\x00\x130\x04\x00\xca\x00\x00\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => ol\x00\x00 ({\x00\x00\x06 \x16(|\x00\x00\x069I\x00\x00\x00& \x05\x00\x00\x008\x18\x00\x00\x00\x06\x80%\x00\x00\x048.\x00\x00\x00 \x01\x00\x00\x00\xfe\x0e\x02\x00\xfe\x0c\x02\x00E\x07\x00\x00\x00k\xff\xff\xff{\xff\xff\xff\xc7\xff\xff\xff\x00\x00\x00\x00\x97\xff\xff\xff\xc7\xff\xff\xff\x10\x00\x00\x008f\xff\xff\xff& \x00\x00\x00\x008\xcf\xff\xff\xff\x00\x07*\x00\x00\x00\x130\x02\x00\x16\x00\x00\x00\x19\x00\x00\x11+\x08(>\xb8Mc\x14P&\x16-\xfa~&\x00\x00\x04 \x00\x06*\x00\x00R+\x08(\x18JTm\x14P&\x16-\xfa\x02\x80&\x00\x00\x04*\x00\x00\x00\x130\x04\x001\x00\x00\x00\x1a\x00\x00\x11+\x08(H\xddTZ\x14P&\x16-\xfa(w\x00\x00\x06r1\x02\x00p~&\x00\x00\x04(~\x00\x00\x06(\x7f\x00\x00\x06\x0b\x07t \x00\x00\x1b \x00\x06*\x00\x00\x00r+\x08(}wCR\x14P&\x16-\xfa\x00\xfe \x00\x00\xfe FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => &8\x03\x00\x00\x00\x16\x13)\x16:`\xfd\xff\xff(\x9d\x00\x00\x06\xdd\x00\x00\x00\x00\x179\x84\xfc\xff\xff(\x9a\x00\x00\x06(\x99\x00\x00\x069}\xfc\xff\xff& \x00\x00\x00\x008\xa3\xfc\xff\xff\x17:\xd1\xfc\xff\xff \x07\x00\x00\x008\x93\xfc\xff\xff*\x00A\x1c\x00\x00\x00\x00\x00\x00\x99\x00\x00\x00\x05\x00\x00\x00\x9e\x00\x00\x00\xf4\x02\x00\x000\x00\x00\x01\x130\x07\x00\x9a\x01\x00\x00\x1f\x00\x00\x11+\x08(\xe3\xcb2D\x14P&\x16-\xfa(\x9a\x00\x00\x06(\x99\x00\x00\x069X\x01\x00\x00& \x04\x00\x00\x00(\x99\x00\x00\x06::\x00\x00\x00&\x08\x80\x0b\x00\x00\x04 \x02\x00\x00\x008)\x00\x00\x00\x08 \x14\x80\x07\x00\x00\x04 1;\x13O\x80\x0b\x00\x00\x04>\x8f\x00\x00\x008\xd4\xff\xff\xff \x04\x00\x00\x00\xfe\x0e\x04\x00\xfe\x0c\x04\x00E \x00\x00\x00\xf2\x00\x00\x00\x10\x00\x00\x00'\x00\x00\x00\xe0\x00\x00\x00\xf2\x00\x00\x00\xae\xff\xff\xffO\x00\x00\x00\x9e\xff\xff\xff\x08 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => \x02\x00D&\x00\x00\x08\x00\x13\x08\xd2\x08\x9d\x01\x02\x00l&\x00\x00\x08\x00\x13\x08\xdc\x08\xa9\x01\x02\x00\x94&\x00\x00\x08\x00\x13\x08\xe6\x08\xb3\x01\x02\x00\xbc&\x00\x00\x08\x00\x93\x00\xf0\x08\\x01\x02\x00\xd4&\x00\x00\x08\x00\x93\x00\x03 \xe9\x00\x02\x00\xe4&\x00\x00\x08\x00\x93\x00\x16 \xe9\x00\x02\x00\xf4&\x00\x00\x08\x00\x03\x08\xbe\x08\x8e\x01\x02\x000'\x00\x00\x08\x00\x06\x18N\x007\x00\x02\x00L'\x00\x00\x08\x00\x93\x00~ \xe9\x00\x02\x00\'\x00\x00\x08\x00\x93\x00\x91 \xe9\x00\x02\x00l'\x00\x00\x08\x00\x06\x08\xd5 \xfe\x01\x02\x00\xa0'\x00\x00\x08\x00\x06\x08\xdf \x02\x02\x00T(\x00\x00\x08\x00\x11\x00\xfb \x13\x02\x03\x00\xd4)\x00\x00\x08\x00\x01\x00&\x0bg\x02\x03\x00\x0c*\x00\x00\x08\x00\x06\x18N\x007\x00\x04\x00(*\x00\x00\x08\x00F\x02X\x0b6\x02\x04\x00T*\x00\x00\x08\x00F\x02_\x0bx\x02\x05\x00x*\x00\x00\x08\x00\x83\x00k\x0b|\x02\x05\x00\xa0* FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => \x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x02\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00E\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00E\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9f\x00\xd9\x02\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\xa2\x03\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00Y\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9f\x00G \x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x9f\x00\xd9\x02\x00\x00\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00\xe7\x18\x00\x00\xb8\x00\x00\x00\x07\x00\x00\x00\xf3\x18\x00\x00\xa2\x86\x00\x00\x01\x00\x00\x00\x0b\x19\x00\x00Z\x87\x00\x00\x01\x00\x00\x00\x1b\x19\x00\x00R\x92\x00\x00\x01\x00\x00\x00C\x19\x00\x00\x06\x00\x05\x00\x07\x00\x05\x00\x08\x00\x05\x00\x0e\x00 \x00\x13\x00\x12\x00\x16\x00\x15\x00\x17\x00\x15\x00\x18\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => xecutablePath\x00TaJAryWeXuSCJdqP18\x00DI7uTl39XJQR76lGj7\x00Q64owI6WL3TD23hUpl\x00IDisposable\x00YBfs4ViQiX8VmXGir8\x00CaKB2Qn4spoofoYPYM\x00ADSHbPdqoiohwE1rxh\x00DpfCAojk2sXXnHD0Sb\x00FFQQN8vsBB8j0lJbCZ\x00J8wXkYpS1EAW5fwyld\x00dDOSqlTeirPDxTmPpw\x00SuspendLayout\x00FkIKJps1Z6G70eJNd7\x00aATcAta FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => \x19 n\x000 2\x00-\x00p\x00Z\x00P\x00-\x00\x00gd\x006\x00f\x000\x005\x00a\x005\x009\x00-\x005\x003\x002\x00e\x00-\x004\x003\x007\x000\x00-\x009\x007\x00b\x004\x00-\x004\x00e\x00a\x008\x005\x003\x001\x005\x004\x00d\x00c\x008\x004\x005\x00b\x008\x00b\x00a\x000\x002\x00-\x009\x002\x00d\x008\x00-\x004\x00\x00\x80\x87:\x00W\x00`\x00m\x00+\x00=\x00K\x001\x009\x00\x7f\x00q\x00;\x00]\x00x\x004\x00f\x00@\x00A\x00i\x00L\x00M\x00Y\x00f\x005\x00+\x00\xc6\x02`\x01H\x00q\x00a\x00E\x00\x18 0\x00]\x00(\x00J\x00K\x00\x18 R\x01#\x00l\x00\x8f\x00j\x00\x81\x00\x19 J\x00\x1a |\x002\x00\xc6\x02l\x00E\x00\x90\x00`\x01\xac \x18 R\x01X\x00 \x00G\x00+\x00 \x00S\x00j\x00Y\x00s FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,291	536	NtReadFile	Buffer => 03f5f7f11d50a3a\x05\x01\x00\x00\x00\x15System.Drawing.Bitmap\x01\x00\x00\x00\x04Data\x07\x02\x02\x00\x00\x00 \x03\x00\x00\x00\x0f\x03\x00\x00\x00\xd1F\x00\x00\x02\x89PNG \x1a \x00\x00\x00 IHDR\x00\x00\x00E\x00\x00\x00E\x08\x06\x00\x00\x00\x1c\x8d+)\x00\x00\x00\x01sRGB\x00\xae\xce\x1c\xe9\x00\x00\x00\x04gAMA\x00\x00\xb1\x8f\x0b\xfca\x05\x00\x00\x00 pHYs\x00\x00\x0e\xc3\x00\x00\x0e\xc3\x01\xc7o\xa8d\x00\x00FfIDATx^\xed\xb9\xe9_\x13\xd7\xfb\xff\x1f\x08\x84-\x93\xcc\x92L\xd8B\xd4\xa8\xb8\x94 FAk\x155*\xb56\xb2D\x83\xd6b\x94\xb4\xa6\xd6Z\x17*\xd4ZK-Uj5\x12\x88\x86Z\xaa\xd4\xa6J\xad\xa5\x88T\xa8\xf5m\x11\xa3 b$\xc9\x90 [\xd6I2 \xb2F@E\xe0\xcb\xe7\xbf\xf8\xdd\xf8\x9d[ FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => \xe4(\xa5\xec\x91\xb1\xd4JW\xd4(S>N\xe7\xcb\xa4f\x10\xab\xf7\xea\x1c\x93\x81\xdet&^\xd8M\x1b\xd7\xbd6\x9f\xe6#o\x1b?FP\xaf\xe8\xb7D\xae\xfe\x03pu*Y\xff\xb4`\xbeYd\x98\x05.0x\xd6u\xaf\x9d\x1c\x00\xc4\xecP\xc3\x91#l\xa1Bk9\x8b\x05)\xf3\xe3\xdc'\xc8\x1eY\xbf\xa8\xe53\xb0>n\x1f\xd5\x1bHJ/Y\xc5\xca\xbe\xd0\x11\x04\x0b\xde\xc5\xa1\xb4\xab:\xfe\x13\xbcb\xc9f5a\xc9\xfaP}S\xe35T%\xb2O\x066\xe7\xcdI\xcf\xaam\xb5\x8b<\xc94N\xd1\xf4\x1cN \xa2a\xb8jW\x88\x91\xa5-\xc0%I\x1f\xbd\xc4*\xcdB\x96\x987W\x04\x12\x9f\x0e\xef\xa2g![Zc=\xc75?S\x9c \x81\xcb\xc4l\x1c\xda\xcbI\x02d\x17x-\xcc)\xd6\x90\xff\xd7t\x96\xc8\xa1\xf0|\xf4\xf7\xe2F\xd1\xe3\xc0\xd3R\xb6\x17\xbbe.\xfe\xf3\x86\x0b r\xa1QH\xbf\xb8\x9c\xc7p*N\xee\x9b+\x86 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => \xb4\x9f\xf5\xbe\xa5\x89q\x9a\x19%\x82E8\xd5\x13\xdft\x8b\xe8\x06:\x8b7Y\x83\x14\x08\x02\xb8\xa4\xa1!\x9c\xcf[\xa0\xe3\xd5\xe3S\x07\xec\xca*l5\xf8\x90\xe9Y\xc7e\x1c`\x13\xb2\xb2\xe3\xbdF\x9a\xf0\x02\xc5\x1e\xed\x93\xe9\xf5\x93p2Q\xb9\x88\xd0 xE)x$9\x82\xc5f\x19ux*\xe8:|-H\xc6\xe8\xcb}\xbb\x0e\xa9\x93,)\xe6\xe51\\xc9h.\x96\x8a"\x8f\xd1=|b_@"7V\xf2\xd2\xcb\xe1\x03\xafJ\x7f\x17\x84\xffxn'\x99E\xf0\xed\x17D5\xaa\x10\xdc\xcf\xf3]O\x10\xff\xa1\xc8\xb8\x17|dp^\xf4vW\xda\xfc\x11\xf6\xcaN\x99\xe6+g\xb9F\xc0\xb4f!\x12%)\xb1_P\xfdD\xef\x10L7?\xf2\xacv\xef\x96\xb5\x8b\xb0\x04pu\xa2\xbd\xba\xeb2\x81)\xeen\x80f\x17\x0e\xc5\xf7,w&\x84\xf4k\xfd$\xe8\x8fh\x93\xae\xf7}?Y\x01\xd4\x10\xb7+\xd2 \xc8\xc8\xcd\x9b\x90\xfb\x18\xbd\xdf\x8f\x08 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => \xb9R\x89\xc6 \xb2 \xa1\xa8\xc2\xfel\xcb\x05\x81\xed\xf1\xb6\xac\x7f\xa2!7n\x9a\xa5 `\xd41`\xf4\x00I#\x97e\x92Q\xcdUkw\xf9\x9f\x02\xbd\xf4x\xdeR\x13\xb4\xf8X\x8c\xfc\x803\xd8\xcdkL\x12\xb8p\x88L\xf9\x85;\xea\xa0g!\x1f\xb6|L\x8c\x98LD4\xbd\xa9*\xbczJ\x9b\xf2{ 3c\xb1&\x11\x07\x9f\xabK.\xd8W\xccC\xab"\xd5K\x93 \xfb{\xf6\x9f+n.\xa4\x8c\x14\x1e\x1aq2\x87J\xe7\xab\x98\x07v>\xda\xf5\x17ytR\xba9+\x08\xba\x00\x91\x8b\x9e\x17\x10\xfd!j\xc1 <<\xe1 \x17\xd0 \x8d\xcb\x82\xa6\xb5T\x96Ek\xf2\x1d5\xc1TY\xe1\x89Tb\xd7d\xa3P\x03\xb4\xcd\x80\x8b \xf7\xae{^\x8a\xa6Ud\x96C.S\xcdLM\xc0\x02\xcbr\xd5\xf9\xeb\xd6\xc2\xfc3\x8eH\xc2\xc1t\xd6\xb0$\xf0!\xf5\xe5\x90L\xc6\xc9\xda\\x047\x90\xea!\x1f\xe7\xb0\x023R\xdaZT\x9dn`\x07 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => \xaf\xef\x98\xc3\x94\x9b\xe2\xc8\xa1g\xb7\x98\xed1X\xa8\xf2\x97\xca]\xf7Ip\xb4]1\x99\xc5R\xa3\xc4\xc8\xf3n\xadWaC\xb2F\x12\x92\xc2 \xcaM\xdbU,\x9c\xf2zo\x8d\x0f\xff\x8d\xbd\x9dW\xbd\xc6X=8\x88\x1e)\xa7\xf8\x92>q\xaa\x95\xe6\xc0Zv\x1e\xdd1Yv<\xae\x90f\x98\x15\xf5 \xb84y\xd8\x8c\xa6\xb0\x0c\xcf\x968\x1f\x10}\xf4V\xeaP\x14r_\xfd\xd3\xfa\xbb\xd2\xcb\x1b|gI\x06]_w\xb3k\xba\x81,\xf6]kp\x03\x98u\xba\xdf\xb6\xb9\xaa\xa8\xc50w"\xb3\xa2W\xb68x8\xb2\x08\xbd\x9a\x1c%\x03\xea\xa4\x1fS\xa1\x1b\x07\x1bj\x19SP\x97H\x15\xf2\xbbq\xe8)z.\xc3\xd9\x10\xa8d(\x8b\xe2\xc8\x8bO\x1fv\xdb\x15\xd8\xe0\x1c\xfd7\xcd4Y\xf0\x00o\xd9\x18\xfc\xbd>\xad\xd8\x97\x08\xe9\x97\x96?B\xde6\xb2]h/\x9b/\x01\xda\xb7!\xea\xc2\xee\x13\xe6 \x82`\x0cA\xe6u\xeb\x9b$\xed\\xa2\x89 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => l]\xae\xd7H\x00\xd1\xc7}\xf42\xf1j\x19@\xa0\xea0\x88#\xe4\xf4\xed\xca\xe0\x7f\xb1z\xdc!L\xf1"m\x0b\x14\x18*\x03\x89s\x90\x19\xcf\xadk?\xb8 \xe3\xd3.H\x88X\x81V*\xd0\xaeD\x0f\xb9\xfe\xf6\xfd\xf0\xf6\xa6\xfb\xaed8\xd7*\x83\x17\xc2\xd8\xfe\xcb\xbaE\xa7`\x1c\xf2\x80z+\xb4J!\xb8\xef\xd1\x12W\xa5\x1a\xbb\x03\x1cTaSpOh\x8a\x02\x8d\x100\xe9a:\xcc\xafAD|;[\xc2\xdex\x97\x0c\xe4\x94Y\xe5a\xe6[\xd1D\x17\xcd\xb6\xb0\xd3\x97AL\x84$\xd0\xf2\x06\xd7\xce\x86\xcc%V\xd2\x82\x87\xb7\xb3x \xebK\x07\xb8\x94\x87\xc2E\x10\x02T >\xe6u\xebKzM\xd8m\xb4\x1cm\x12L\x9f\xe2 8\x05'\x9d\xfb$w\xffY \xdd\xffX\xffa\xca\x03\xcd\x8c`,\xf7\xa2\xb2y\x10\x17\xf8\xd6\xe5\xdf\xf5j\xac\x8bO!\x90~\x1c\x02g\xe9\xaeW\xda,m\x8a\x18w\xb0\xb4\x82\xdcf\xbe\xe3\x11\xf0\x9a\x95\xc0 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,381	536	NtReadFile	Buffer => Y\xf5n\x12\xec\x9cpdb^\xb8\xf4O\x10\xfd\x8ap\xd9X\x8bMN7\xe2\xb5\x8c\xa9\xcb8X\xa9\ \x1d\xbef(\x0b#J\x9b\xfb\x16\xd6\xed\x10m\xcc\xef`\xf8\xbc"\xd5\xc5q\x07\xac\x02\x1aO\xf4\xcb\x96UFB.\xc3\xa9\x80\x80\xcf@%|?,Iw+\xa7dsk\x18\xd4#_\xc3\xcd!^\xe5\x15i\x90\x7f&\xad\xe7\x0f\x95Y\x18\xf2\x8ca\xe3\xab\x9b\xb7\xb7v *'\xb2\xae\xff:vvQW\xd1Vdj\xa3\xbd?7\x99Pa?;\x08\xe5\xda9JuB{C\x8b\xc6d\xae@\x1cD\xe0\xd0\xf1\xe4\xb7l\xce\x0c:\x810A\xbc3s(\xbd\xb2b\xfbdy_&\x9e\xbf\xa5G*k`]pw\x84\xbf\xa1\xbaoD\x93\xdc+ \x16\x87X|]\xb8\xc5c\xa8\xbc\x88\x1b\x86\xa6\x9d\x03\xda#\xca\xe5\xadBLF7N\x81\x16\xde\xef\xd2\xa5\xdb\xe7\xee\xc6\x05P`ie\]\x10\xf3\xcc\x03z\x83\x9d\x92\xe2\x0c\xde\x94{\x03d FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => \x9f\xc2\xbaa\xac\i\x87l\xc1\xed\xbe\xceP&\xd4\x13\xf7\xe8)\xe3\x14\xe2\xf1\xf3]f\x00i\x10f\xbb\x05W+\x0faN\xf7\xf9nV\xbdG72\xb7ua\x9a^\xf3\xaai\x04c\x1an\xe9?\x83\xd7\xb8jW\x05\x99\x7f\xfd\xd1\x81\xde\x88m\x81\x9a%\xcb\x13%\x8e\x91\xe7\xc8c=(cI#j\xf29`\xdc\xdd\xb7\xb58\xe1\x1a\xbb\x9e\x13\x03\xa8x\xe64J\xa3\x81"\xc9\x11\xde\xcdWc\xa8\x11\xe3\x08\xe1\xf0\x1d\xa3k\x8c'\x1e\x91\x811\x01\x0c\xdaf\xc4\xe41\xb2>\x03\x8f\x8f6\xd78\x90e\x82\xda\xb4\xaei\x8f. \x8c\x92-\x89\xbb\xf6\x9b\xf2aa\xd7\xfcE\x13?\x93\xc0\xcc;\xab;\x94I}\xbf\x97\xdb\x88\xed\xb9\xa4\x02\xf3\xe9mP\x82 \xd7Tv\x9fb\xc3\x13\xf9\xa5\x9f\x87\x0c\x08[N\x801 \xad\xbf\x00;\xa0[\x9d\xb6\x9e\x14#I\xf0\xc3\x9e\xb9db\xf0ss\xeb\xb5\xe4s]\xc2\xe5QKm\x8e\x0fAd\xc9\xce*\xc14\xd1 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => \x84VH\xe7\xcc\x04V`\x16\xcb\xc3\xfe\xd4\x12\x9f\xf9\xf7\xe6\x03\x81#\x851\xb6H?\xcd\xc3\x16\xc8\xdeU^\x96\xe8\x12\x849\x954\x9eHIC\x9d\xcc\x1d\x8b-\x8f'\xa4Z-\xdf\xd1(\xaa\xfc3x\xb0 \xb4\xea\x17oZ0\xb6\x03\x8dk\x82_MgIeb\x94\xfb \x87Z|2q:\xf2\xcc\xf6\xa8U1\x90\xfa\xec\xad\xe7\x01X\x89\xf7\x11S{p\x86 \xbb\xf5\x0c\xce\xe0?t\xbc\x0e\xb8\xde\x03{FLz7a\x7fn{i\x8b\xed\xc9\xbeP7\xd5\xdb\x1e\xc0\xd6Mf\xae\x00\xaa\xcc\xf1\xcd\xfc\xd6\x10\xa1\xeb\x05T\x95\x13\xb5\xf7\xdf\xcc\x02\x85GI\x90BT\xcb\xe0(\x82,R\x8f\x07\xc2\xc8\xfe\xbb\xd5\x13J\x97\x15\xaf\x11\xbd*\xdc\xb3Q_\xa24j\xc9\xe2*\x84.P\x8d \xb8\x12\xd4\xe5\xafI\xa0A?\xd9\x9b3\xb8NA\x83 \xd4\x06\x98\x17\x9cT&\xd0\xc6\xfb\xd3\xee\xe4\xe2\xaf\xe9\x07V\x93\x11\xb3\xf5\xe1\xe6\x18o\x9d\x13\xe6\xf8\xae\x05 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => blicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\x02\x00\x00\x00\x0b\x00\x00\x00\x04\x00\x00\x00fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=2.0.0.0, Culture=neutral, FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => culture\x06m_name\x00\x00\x01\x08\x08\x7f\x00\x00\x00\x7f\x00\x00\x00 \x05\x00\x00\x00\x04\x03\x00\x00\x00\x1dSystem.Globalization.TextInfo\x06\x00\x00\x00\x0fm_listSeparator\x0cm_isReadOnly\x11customCultureName\x0bm_nDataItem\x11m_useUserOverride m_win32LangID\x01\x00\x01\x00\x00\x00\x01\x08\x01\x08\x06\x06\x00\x00\x00\x01,\x01 \xca\x00\x00\x00\x00\x7f\x00\x00\x00\x04\x04\x00\x00\x00%System.Globalization.NumberFormatInfo!\x00\x00\x00\x10numberGroupSizes\x12c FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => A\x1c\x17\x00A\x19\x15\x00WSr\x00D>^\x00Px\x98\x00x\xb9\xce\x00\xb1\xd4\xdf\x00\xac\xca\xcb\x00wg;\x00xg:\x00{f<\x00\x87vQ\x00{sV\x00\x85\x9b\x9b\x00\x86\xa0\xa7\x00v\x80\x8b\x00smn\x00xz\x83\x00yw~\x00odd\x00|\x81\x99\x00x\x86\xa8\x00w\x82\x9f\x00`@0\x00]9,\x00\8+\x00U3%\x00X8/\x00R/&\x00K.4\x00O13\x00I'$\x00F \x1c\x00A\x1f\x1f\x00FIg\x00J^\x80\x00_\x8e\xb3\x00\x86\xc2\xd0\x00\x90\xb3\xb5\x00\xaa\xd1\xcf\x00\x81~Q\x00\x82zN\x00\x85\x7fT\x00\x87\x88_\x00\x87\x8fz\x00\x91\xb5\xbd\x00\x8f\xb0\xb9\x00\x88\x98\x9f\x00\x82\x85\x86\x00\x81\x85\x88\x00\x81\x82\x8a\x00\x80\x83\x8e\x00\x80\x8a\xa5\x00\x84\x94\xb0\x00\x82\x94\xb1\x00\x85\x7f\x87\x00dC3\x00a@0\x00eD5\x00cF=\x00Y5+\x00T=C\x00VBO\x00J2;\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,391	536	NtReadFile	Buffer => <\x16\x11\x00;\x15\x10\x00:\x14\x0f\x007\x12\x0e\x006\x11 \x005\x10\x0c\x003\x0e\x0c\x00/ \x00,\x0b\x08\x00, \x00(\x0e\x18\x00 \x0c\x1b\x00)\x1f3\x0010M\x00+\x0f \x00<&(\x00-\x0e\x0b\x00(\x05\x03\x00Y5\x18\x00V1\x15\x00T/\x15\x00R(\x11\x00Y0\x1a\x00V,\x18\x00T1\x1d\x00U5"\x00n_]\x00d^g\x00XP[\x00L<C\x00]S^\x00dNW\x00]Xk\x00W?G\x00`NU\x00S.!\x00W.'\x00O%\x1e\x00N$\x1d\x00L%\x1d\x00K$\x1c\x00H!\x19\x00H!\x19\x00F\x1f\x17\x00C\x1c\x14\x00C\x1d\x18\x00C\x1d\x18\x00A\x1b\x16\x00@\x1a\x15\x00?\x19\x14\x00>\x18\x13\x00<\x16\x12\x00;\x15\x11\x00:\x14\x10\x007\x12\x0e\x003\x10\x0c\x000\x10\x0b\x00/\x0f\x13\x00-\x1b,\x00*\x1d.\x007:`\x00>BZ\x00ll{\x00:(/\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,401	536	NtReadFile	Buffer => t\xaf\xc4\x00w\xb1\xc7\x00\xc5\xe9\xe9\x00\xcd\xef\xef\x00\xd3\xf2\xf3\x00\xd6\xf5\xf6\x00\xd8\xf7\xf8\x00\xdb\xfa\xf9\x00\xdf\xfb\xfb\x00\xe1\xfc\xfc\x00\xcf\xf8\xf1\x00\xcf\xec\xdb\x00\xc1\xe0\xd1\x00\xbd\xde\xd8\x00\xc1\xe8\xef\x00\xbb\xe3\xe8\x00\xb8\xdf\xe7\x00\xb0\xda\xe1\x00\xb0\xd0\xdd\x00\xab\xc5\xd6\x00\xaa\xc9\xdc\x00\xa7\xc9\xe1\x00\xa7\xc5\xe5\x00\xae\xd6\xf2\x00\xa0\xc7\xf1\x00\x99\xab\xc8\x00\x8b\x8c\x9a\x00\x88\x91\xaa\x00\x82\x92\xb5\x00\x89\x8d\xb6\x00\x7f\x82\xa0\x00wn~\x00qjv\x00lY_\x00f`e\x00`Wc\x00acu\x00aYj\x00\x7f\xa9\xc8\x00s\xa5\xb3\x00i\x96\xac\x00z\xb3\xc7\x00\x80\xb7\xcc\x00{\xb4\xcd\x00{\xc2\xd5\x00n\x9f\xb4\x00w\xb1\xc3\x00x\xb4\xca\x00w\xb0\xc7\x00s\xac\xc5\x00\xc5\xe9\xe9\x00\xcd\xef\xef\x00\xd1\xf3\xf3\x00\xd6\xf5\xf6\x00\xd8\xf7\xf8\x00\xdb\xfa\xf9\x00\xdd\xfb\xfc\x00\xe0\xfc\xfc\x00\xcd\xf4\xec\x00\xd5\xef\xe0\x00\xc4\xe2\xcd\x00\xbd\xdd\xd3\x00\xbe\xe8\xef\x00\xbb\xe5\xec\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,401	536	NtReadFile	Buffer => \x9f\xdc\xe3\x00\xa8\xe6\xe0\x00\x9d\xcf\xcf\x00\x83\xa8\xac\x00\x81\xa6\xab\x00\x8e\xac\xac\x00t\x83\x82\x00w\x81\x7f\x00{\x81\x80\x00w\x88\x8a\x00p\x85\x86\x00v\x86\x8d\x00gv\x83\x00nw\x85\x00`gw\x00k\x94\xa7\x00}\xc3\xd2\x00\x83\xbc\xd5\x00t\xa6\xba\x00Mo\x8a\x00^\x9b\xc8\x00Y\x9a\xc6\x00e\xa8\xcd\x00V\x94\xbc\x00X\x93\xc0\x00R\x89\xb6\x00P\x85\xb0\x00R\x8d\xb4\x00]\x97\xba\x00d\x9d\xbd\x00f\xa1\xc4\x00V\x85\xa7\x00;Ni\x003CZ\x00\xa3\xc1\xbd\x00\xa0\xc2\xbb\x00\x94\xb9\xaf\x00\x8f\xb8\xa9\x00\x8c\xb5\xa6\x00\x8d\xb8\xa9\x00\x94\xbf\xb0\x00\x8e\xbd\xad\x00\x8f\xc0\xb2\x00\x96\xcb\xbd\x00\xa2\xd9\xcc\x00\xa9\xe3\xd8\x00\xa5\xde\xd5\x00\xac\xe8\xde\x00\x9a\xd7\xdf\x00\x8f\xc9\xe0\x00\x97\xcf\xd9\x00\xb1\xea\xe5\x00\x92\xbe\xbe\x00|\xa4\xab\x00t\x95\x9e\x00{\x9b\xa6\x00~\x9c\xa8\x00s\x94\xa1\x00\x81\x9f\xb3\x00q\x8d\xa2\x00b|\x90\x00]~\x8f\x00\x89\xc1\xd2\x00\x83\xc4\xd7\x00 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,401	536	NtReadFile	Buffer => FileHandle => 0x000001bc	FAILURE	3221225489	1 time
21:05:16,411	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,421	536	NtQueryInformationFile	FileHandle => 0x000001bc FileInformation => \x00P\x00\x00\x00\x00\x00\x00`O\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:16,421	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000001b8 FileHandle => 0x000001bc	SUCCESS	0x00000000
21:05:16,421	536	ZwMapViewOfSection	SectionOffset => 0x0012cefc SectionHandle => 0x000001b8 ProcessHandle => 0xffffffff BaseAddress => 0x011e0000	SUCCESS	0x00000000
21:05:16,431	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001c0	SUCCESS	0x00000000
21:05:16,431	536	NtQueryInformationFile	FileHandle => 0x000001c0 FileInformation => \x00\x10\x04\x00\x00\x00\x00\x00\x04\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
21:05:16,431	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000001c4 FileHandle => 0x000001c0	SUCCESS	0x00000000
21:05:16,431	536	ZwMapViewOfSection	SectionOffset => 0x0012dc2c SectionHandle => 0x000001c4 ProcessHandle => 0xffffffff BaseAddress => 0x011f0000	SUCCESS	0x00000000
21:05:16,451	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x013c0000	SUCCESS	0x00000000
21:05:16,542	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a6948
21:05:16,542	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW	SUCCESS	0x001a6948
21:05:16,542	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW\LOCALS~1	SUCCESS	0x001a6948
21:05:16,542	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileAttributesEx FunctionAddress => 0x7912cde1 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:16,542	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileAttributesExW FunctionAddress => 0x7c811185 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,552	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000158 SubKey => NI\2ff05403\4347f54d	FAILURE	0x00000002
21:05:16,562	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1935655697-1606980848-1060284298-1003\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,562	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,562	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,562	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1935655697-1606980848-1060284298-1003\Installer\Assemblies\Global	FAILURE	0x00000002
21:05:16,562	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Installer\Assemblies\Global	FAILURE	0x00000002
21:05:16,572	536	RegOpenKeyExW	Handle => 0x000001c8 Registry => 0x80000002 SubKey => SOFTWARE\Classes\Installer\Assemblies\Global	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 0 Handle => 0x000001c8 DataLength => 0 ValueName => WindowsFormsIntegration,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 1 Handle => 0x000001c8 DataLength => 0 ValueName => System.Speech,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 2 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationClientsideProviders,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 3 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationClient,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 4 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationBuildTasks,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 5 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Transactions.Bridge.Dtc,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="x86",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 6 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Transactions.Bridge,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 7 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.WasHosting,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 8 Handle => 0x000001c8 DataLength => 0 ValueName => System.Runtime.Serialization,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 9 Handle => 0x000001c8 DataLength => 0 ValueName => System.IO.Log,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 10 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.Install,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,572	536	RegEnumValueW	Index => 11 Handle => 0x000001c8 DataLength => 0 ValueName => SMDiagnostics,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 12 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 13 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationTypes,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 14 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationUI,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 15 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationCFFRasterizer,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 16 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.Activities,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 17 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.Runtime,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,582	536	RegEnumValueW	Index => 18 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.ComponentModel,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 19 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Classic,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 20 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 21 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Aero,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 22 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Luna,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 23 Handle => 0x000001c8 DataLength => 0 ValueName => WindowsBase,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 24 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationCore,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 25 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationProvider,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 26 Handle => 0x000001c8 DataLength => 0 ValueName => ReachFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,592	536	RegEnumValueW	Index => 27 Handle => 0x000001c8 DataLength => 0 ValueName => System.Printing,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 28 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Royale,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 29 Handle => 0x000001c8 DataLength => 0 ValueName => System.IdentityModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 30 Handle => 0x000001c8 DataLength => 0 ValueName => System.IdentityModel.Selectors,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 31 Handle => 0x000001c8 DataLength => 0 ValueName => System.DirectoryServices.AccountManagement,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 32 Handle => 0x000001c8 DataLength => 0 ValueName => System.Net,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 33 Handle => 0x000001c8 DataLength => 0 ValueName => System.Web.Extensions.Design,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 34 Handle => 0x000001c8 DataLength => 0 ValueName => System.Web.Extensions,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 35 Handle => 0x000001c8 DataLength => 0 ValueName => System.Core,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,602	536	RegEnumValueW	Index => 36 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Conversion.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 37 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Utilities.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 38 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Tasks.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 39 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Engine,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 40 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Framework,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 41 Handle => 0x000001c8 DataLength => 0 ValueName => System.Data.DataSetExtensions,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 42 Handle => 0x000001c8 DataLength => 0 ValueName => System.AddIn,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 43 Handle => 0x000001c8 DataLength => 0 ValueName => System.AddIn.Contract,version="2.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 44 Handle => 0x000001c8 DataLength => 0 ValueName => System.Data.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 45 Handle => 0x000001c8 DataLength => 0 ValueName => System.Xml.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,612	536	RegEnumValueW	Index => 46 Handle => 0x000001c8 DataLength => 0 ValueName => System.Management.Instrumentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,622	536	RegEnumValueW	Index => 47 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.Web,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,622	536	RegEnumValueW	Index => 48 Handle => 0x000001c8 DataLength => 0 ValueName => System.WorkflowServices,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,622	536	RegEnumValueW	Index => 49 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.VisualC.STLCLR,version="1.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,622	536	RegEnumValueW	Index => 50 Handle => 0x000001c8 DataLength => 0 ValueName => System.Windows.Presentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,622	536	RegEnumValueW	Index => 51 Handle => 0x000001c8 DataLength => 0 ValueName => System.Windows.Presentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 1780488	FAILURE	0x00000103
21:05:16,622	536	RegCloseKey	Handle => 0x000001c8	SUCCESS	0x00000000
21:05:16,642	536	LdrLoadDll	Flags => 1230664 BaseAddress => 0x60340000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll	SUCCESS	0x00000000
21:05:16,652	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ConvertLangIdToCultureName FunctionAddress => 0x60343332 ModuleHandle => 0x60340000	SUCCESS	0x00000000
21:05:16,662	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll	FAILURE	3221225781
21:05:16,662	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll	FAILURE	3221225781
21:05:16,672	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll	FAILURE	3221225781
21:05:16,672	536	NtCreateFile	ShareAccess => 5 FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:16,672	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000001c8 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:16,672	536	ZwMapViewOfSection	SectionOffset => 0x0012c97c SectionHandle => 0x000001c8 ProcessHandle => 0xffffffff BaseAddress => 0x013c0000	SUCCESS	0x00000000
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000158 SubKey => NI\2ff05403\4904e667	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1935655697-1606980848-1060284298-1003\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\Installer\Assemblies\C:|DOCUME~1|TDW|LOCALS~1|Temp|phphotoset.scr	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1935655697-1606980848-1060284298-1003\Installer\Assemblies\Global	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Installer\Assemblies\Global	FAILURE	0x00000002
21:05:16,682	536	RegOpenKeyExW	Handle => 0x000001c8 Registry => 0x80000002 SubKey => SOFTWARE\Classes\Installer\Assemblies\Global	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 0 Handle => 0x000001c8 DataLength => 0 ValueName => WindowsFormsIntegration,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 1 Handle => 0x000001c8 DataLength => 0 ValueName => System.Speech,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 2 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationClientsideProviders,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 3 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationClient,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 4 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationBuildTasks,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 5 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Transactions.Bridge.Dtc,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="x86",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 6 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Transactions.Bridge,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,692	536	RegEnumValueW	Index => 7 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.WasHosting,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 8 Handle => 0x000001c8 DataLength => 0 ValueName => System.Runtime.Serialization,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 9 Handle => 0x000001c8 DataLength => 0 ValueName => System.IO.Log,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 10 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.Install,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 11 Handle => 0x000001c8 DataLength => 0 ValueName => SMDiagnostics,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 12 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 13 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationTypes,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 14 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationUI,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 15 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationCFFRasterizer,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 16 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.Activities,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 17 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.Runtime,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,702	536	RegEnumValueW	Index => 18 Handle => 0x000001c8 DataLength => 0 ValueName => System.Workflow.ComponentModel,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 19 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Classic,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 20 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 21 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Aero,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 22 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Luna,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 23 Handle => 0x000001c8 DataLength => 0 ValueName => WindowsBase,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 24 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationCore,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 25 Handle => 0x000001c8 DataLength => 0 ValueName => UIAutomationProvider,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,712	536	RegEnumValueW	Index => 26 Handle => 0x000001c8 DataLength => 0 ValueName => ReachFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 27 Handle => 0x000001c8 DataLength => 0 ValueName => System.Printing,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 28 Handle => 0x000001c8 DataLength => 0 ValueName => PresentationFramework.Royale,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 29 Handle => 0x000001c8 DataLength => 0 ValueName => System.IdentityModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 30 Handle => 0x000001c8 DataLength => 0 ValueName => System.IdentityModel.Selectors,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 31 Handle => 0x000001c8 DataLength => 0 ValueName => System.DirectoryServices.AccountManagement,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 32 Handle => 0x000001c8 DataLength => 0 ValueName => System.Net,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 33 Handle => 0x000001c8 DataLength => 0 ValueName => System.Web.Extensions.Design,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 34 Handle => 0x000001c8 DataLength => 0 ValueName => System.Web.Extensions,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,722	536	RegEnumValueW	Index => 35 Handle => 0x000001c8 DataLength => 0 ValueName => System.Core,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 36 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Conversion.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 37 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Utilities.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 38 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Tasks.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 39 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Engine,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 40 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.Build.Framework,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 41 Handle => 0x000001c8 DataLength => 0 ValueName => System.Data.DataSetExtensions,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,732	536	RegEnumValueW	Index => 42 Handle => 0x000001c8 DataLength => 0 ValueName => System.AddIn,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 43 Handle => 0x000001c8 DataLength => 0 ValueName => System.AddIn.Contract,version="2.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 44 Handle => 0x000001c8 DataLength => 0 ValueName => System.Data.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 45 Handle => 0x000001c8 DataLength => 0 ValueName => System.Xml.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 46 Handle => 0x000001c8 DataLength => 0 ValueName => System.Management.Instrumentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 47 Handle => 0x000001c8 DataLength => 0 ValueName => System.ServiceModel.Web,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 48 Handle => 0x000001c8 DataLength => 0 ValueName => System.WorkflowServices,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 49 Handle => 0x000001c8 DataLength => 0 ValueName => Microsoft.VisualC.STLCLR,version="1.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 50 Handle => 0x000001c8 DataLength => 0 ValueName => System.Windows.Presentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 7	SUCCESS	0x00000000
21:05:16,742	536	RegEnumValueW	Index => 51 Handle => 0x000001c8 DataLength => 0 ValueName => System.Windows.Presentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" Type => 1785864	FAILURE	0x00000103
21:05:16,752	536	RegCloseKey	Handle => 0x000001c8	SUCCESS	0x00000000
21:05:16,772	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetACP FunctionAddress => 0x7c8099a5 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,782	536	NtOpenSection	DesiredAccess => 0x00000004 ObjectAttributes => C:\Global\NLS_CodePage_1252_3_2_0_0 SectionHandle => 0x00000000	FAILURE	3221225524
21:05:16,782	536	NtOpenSection	DesiredAccess => 0x00000004 ObjectAttributes => C:\NLS_CodePage_1252_3_2_0_0 SectionHandle => 0x00000000	FAILURE	3221225524
21:05:16,792	536	NtCreateSection	ObjectAttributes => C:\Global\NLS_CodePage_1252_3_2_0_0 DesiredAccess => 0x000f0007 SectionHandle => 0x000001c8 FileHandle => 0x00000000	SUCCESS	0x00000000
21:05:16,792	536	ZwMapViewOfSection	SectionOffset => 0x0012e7dc SectionHandle => 0x000001c8 ProcessHandle => 0xffffffff BaseAddress => 0x01420000	SUCCESS	0x00000000
21:05:16,792	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnmapViewOfFile FunctionAddress => 0x7c80ba04 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,792	536	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
21:05:16,792	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GlobalMemoryStatusEx FunctionAddress => 0x7c81f97a ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:16,952	536	FindFirstFileExW	FileName => C:/DOCUME~1	SUCCESS	0x001a4e48
21:05:16,952	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW	SUCCESS	0x001a4e48
21:05:16,952	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW/LOCALS~1	SUCCESS	0x001a4e48
21:05:16,952	536	FindFirstFileExW	FileName => C:/DOCUME~1/TDW/LOCALS~1/Temp	SUCCESS	0x001a4e48
21:05:16,992	536	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000001cc FileHandle => 0x00000000	SUCCESS	0x00000000
21:05:16,992	536	ZwMapViewOfSection	SectionOffset => 0x0012ea24 SectionHandle => 0x000001cc ProcessHandle => 0xffffffff BaseAddress => 0x01440000	SUCCESS	0x00000000
21:05:17,032	536	LdrLoadDll	Flags => 1238912 BaseAddress => 0x79000000 FileName => mscoree.dll	SUCCESS	0x00000000
21:05:17,032	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetMetaDataInternalInterface FunctionAddress => 0x79008adb ModuleHandle => 0x79000000	SUCCESS	0x00000000
21:05:17,112	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01450000	SUCCESS	0x00000000
21:05:17,112	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a4e48
21:05:17,112	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001a4e48
21:05:17,112	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001a4e48
21:05:17,112	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001a4e48
21:05:17,112	536	LdrLoadDll	Flags => 1237332 BaseAddress => 0x7c800000 FileName => kernel32	SUCCESS	0x00000000
21:05:17,112	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteFile FunctionAddress => 0x014420db ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:17,112	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteFileW FunctionAddress => 0x7c831f4b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:17,122	536	DeleteFileW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr:Zone.Identifier	FAILURE	0x00000000
21:05:17,122	536	NtDelayExecution	Milliseconds => 5000	SUCCESS	0x00000000
21:05:22,130	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW	SUCCESS	0x001a4e48
21:05:22,130	536	FindFirstFileExW	FileName => C:\Documents and Settings\TDW\LOCALS~1	SUCCESS	0x001a4e48
21:05:22,140	536	NtCreateFile	ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\phphotoset.scr DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,140	536	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00\xe2 \xbdS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0e\x01\x0b\x01\x06\x00\x00"\x01\x00\x00H\x00\x00\x00\x00\x00\x00\xbeA\x01\x00\x00 \x00\x00\x00`\x01\x00\x00\x00@\x00\x00 \x00\x00\x00\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,140	536	NtReadFile	Buffer => \xfa\x02\x8c\x08\x00\x00\x1b:\x10\x00\x00\x00(\x04\x00\x00+ 8\x08\x00\x00\x008\x03\x00\x00\x00\x02 \x00\x06*\x00\x00\x00\x130\x03\x00\x1d\x00\x00\x00\x0c\x00\x00\x11+\x08(7B\x006\x14P&\x16-\xfa\x03\x12\x00\xfe\x15\x08\x00\x00\x1b\x06\x81\x08\x00\x00\x1b*\x00\x00\x00f+\x08(\xe0\x87\x02/\x14P&\x16-\xfa(\xb1\x00\x00\x06\x02(+\x00\x00 *\x00\x00b+\x08(\x9f=[S\x14P&\x16-\xfa\x00\xfe \x00\x00(<\x00\x00 *\x00\x00\x00n+\x08(\xc2\xa0kE\x14P&\x16-\xfa\xfe \x00\x00\xfe \x01\x00(=\x00\x00 *>+\x08(\x04'\x18F\x14P&\x16-\xfa\x17*>+\x08(\x99\xc6XI\x14P&\x16-\xfa\x16*^+\x08(Z*Rg\x14P&\x16-\xfa\xfe \x00\x00(;\x00\x00 *b+\x08(\xa3\xd22^\x14P&\x16-\xfa\x00\xfe \x00\x00(.\x00\x00 *\x00\x00\x00\x130\x04\x00\xca\x00\x00\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,140	536	NtReadFile	Buffer => ol\x00\x00 ({\x00\x00\x06 \x16(|\x00\x00\x069I\x00\x00\x00& \x05\x00\x00\x008\x18\x00\x00\x00\x06\x80%\x00\x00\x048.\x00\x00\x00 \x01\x00\x00\x00\xfe\x0e\x02\x00\xfe\x0c\x02\x00E\x07\x00\x00\x00k\xff\xff\xff{\xff\xff\xff\xc7\xff\xff\xff\x00\x00\x00\x00\x97\xff\xff\xff\xc7\xff\xff\xff\x10\x00\x00\x008f\xff\xff\xff& \x00\x00\x00\x008\xcf\xff\xff\xff\x00\x07*\x00\x00\x00\x130\x02\x00\x16\x00\x00\x00\x19\x00\x00\x11+\x08(>\xb8Mc\x14P&\x16-\xfa~&\x00\x00\x04 \x00\x06*\x00\x00R+\x08(\x18JTm\x14P&\x16-\xfa\x02\x80&\x00\x00\x04*\x00\x00\x00\x130\x04\x001\x00\x00\x00\x1a\x00\x00\x11+\x08(H\xddTZ\x14P&\x16-\xfa(w\x00\x00\x06r1\x02\x00p~&\x00\x00\x04(~\x00\x00\x06(\x7f\x00\x00\x06\x0b\x07t \x00\x00\x1b \x00\x06*\x00\x00\x00r+\x08(}wCR\x14P&\x16-\xfa\x00\xfe \x00\x00\xfe FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,140	536	NtReadFile	Buffer => &8\x03\x00\x00\x00\x16\x13)\x16:`\xfd\xff\xff(\x9d\x00\x00\x06\xdd\x00\x00\x00\x00\x179\x84\xfc\xff\xff(\x9a\x00\x00\x06(\x99\x00\x00\x069}\xfc\xff\xff& \x00\x00\x00\x008\xa3\xfc\xff\xff\x17:\xd1\xfc\xff\xff \x07\x00\x00\x008\x93\xfc\xff\xff*\x00A\x1c\x00\x00\x00\x00\x00\x00\x99\x00\x00\x00\x05\x00\x00\x00\x9e\x00\x00\x00\xf4\x02\x00\x000\x00\x00\x01\x130\x07\x00\x9a\x01\x00\x00\x1f\x00\x00\x11+\x08(\xe3\xcb2D\x14P&\x16-\xfa(\x9a\x00\x00\x06(\x99\x00\x00\x069X\x01\x00\x00& \x04\x00\x00\x00(\x99\x00\x00\x06::\x00\x00\x00&\x08\x80\x0b\x00\x00\x04 \x02\x00\x00\x008)\x00\x00\x00\x08 \x14\x80\x07\x00\x00\x04 1;\x13O\x80\x0b\x00\x00\x04>\x8f\x00\x00\x008\xd4\xff\xff\xff \x04\x00\x00\x00\xfe\x0e\x04\x00\xfe\x0c\x04\x00E \x00\x00\x00\xf2\x00\x00\x00\x10\x00\x00\x00'\x00\x00\x00\xe0\x00\x00\x00\xf2\x00\x00\x00\xae\xff\xff\xffO\x00\x00\x00\x9e\xff\xff\xff\x08 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,150	536	NtReadFile	Buffer => \x02\x00D&\x00\x00\x08\x00\x13\x08\xd2\x08\x9d\x01\x02\x00l&\x00\x00\x08\x00\x13\x08\xdc\x08\xa9\x01\x02\x00\x94&\x00\x00\x08\x00\x13\x08\xe6\x08\xb3\x01\x02\x00\xbc&\x00\x00\x08\x00\x93\x00\xf0\x08\\x01\x02\x00\xd4&\x00\x00\x08\x00\x93\x00\x03 \xe9\x00\x02\x00\xe4&\x00\x00\x08\x00\x93\x00\x16 \xe9\x00\x02\x00\xf4&\x00\x00\x08\x00\x03\x08\xbe\x08\x8e\x01\x02\x000'\x00\x00\x08\x00\x06\x18N\x007\x00\x02\x00L'\x00\x00\x08\x00\x93\x00~ \xe9\x00\x02\x00\'\x00\x00\x08\x00\x93\x00\x91 \xe9\x00\x02\x00l'\x00\x00\x08\x00\x06\x08\xd5 \xfe\x01\x02\x00\xa0'\x00\x00\x08\x00\x06\x08\xdf \x02\x02\x00T(\x00\x00\x08\x00\x11\x00\xfb \x13\x02\x03\x00\xd4)\x00\x00\x08\x00\x01\x00&\x0bg\x02\x03\x00\x0c*\x00\x00\x08\x00\x06\x18N\x007\x00\x04\x00(*\x00\x00\x08\x00F\x02X\x0b6\x02\x04\x00T*\x00\x00\x08\x00F\x02_\x0bx\x02\x05\x00x*\x00\x00\x08\x00\x83\x00k\x0b|\x02\x05\x00\xa0* FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,150	536	NtReadFile	Buffer => \x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x02\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00E\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00E\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9f\x00\xd9\x02\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\xa2\x03\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00Y\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9f\x00G \x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x9f\x00\xd9\x02\x00\x00\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00\xe7\x18\x00\x00\xb8\x00\x00\x00\x07\x00\x00\x00\xf3\x18\x00\x00\xa2\x86\x00\x00\x01\x00\x00\x00\x0b\x19\x00\x00Z\x87\x00\x00\x01\x00\x00\x00\x1b\x19\x00\x00R\x92\x00\x00\x01\x00\x00\x00C\x19\x00\x00\x06\x00\x05\x00\x07\x00\x05\x00\x08\x00\x05\x00\x0e\x00 \x00\x13\x00\x12\x00\x16\x00\x15\x00\x17\x00\x15\x00\x18\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,150	536	NtReadFile	Buffer => xecutablePath\x00TaJAryWeXuSCJdqP18\x00DI7uTl39XJQR76lGj7\x00Q64owI6WL3TD23hUpl\x00IDisposable\x00YBfs4ViQiX8VmXGir8\x00CaKB2Qn4spoofoYPYM\x00ADSHbPdqoiohwE1rxh\x00DpfCAojk2sXXnHD0Sb\x00FFQQN8vsBB8j0lJbCZ\x00J8wXkYpS1EAW5fwyld\x00dDOSqlTeirPDxTmPpw\x00SuspendLayout\x00FkIKJps1Z6G70eJNd7\x00aATcAta FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,150	536	NtReadFile	Buffer => \x19 n\x000 2\x00-\x00p\x00Z\x00P\x00-\x00\x00gd\x006\x00f\x000\x005\x00a\x005\x009\x00-\x005\x003\x002\x00e\x00-\x004\x003\x007\x000\x00-\x009\x007\x00b\x004\x00-\x004\x00e\x00a\x008\x005\x003\x001\x005\x004\x00d\x00c\x008\x004\x005\x00b\x008\x00b\x00a\x000\x002\x00-\x009\x002\x00d\x008\x00-\x004\x00\x00\x80\x87:\x00W\x00`\x00m\x00+\x00=\x00K\x001\x009\x00\x7f\x00q\x00;\x00]\x00x\x004\x00f\x00@\x00A\x00i\x00L\x00M\x00Y\x00f\x005\x00+\x00\xc6\x02`\x01H\x00q\x00a\x00E\x00\x18 0\x00]\x00(\x00J\x00K\x00\x18 R\x01#\x00l\x00\x8f\x00j\x00\x81\x00\x19 J\x00\x1a |\x002\x00\xc6\x02l\x00E\x00\x90\x00`\x01\xac \x18 R\x01X\x00 \x00G\x00+\x00 \x00S\x00j\x00Y\x00s FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,150	536	NtReadFile	Buffer => 03f5f7f11d50a3a\x05\x01\x00\x00\x00\x15System.Drawing.Bitmap\x01\x00\x00\x00\x04Data\x07\x02\x02\x00\x00\x00 \x03\x00\x00\x00\x0f\x03\x00\x00\x00\xd1F\x00\x00\x02\x89PNG \x1a \x00\x00\x00 IHDR\x00\x00\x00E\x00\x00\x00E\x08\x06\x00\x00\x00\x1c\x8d+)\x00\x00\x00\x01sRGB\x00\xae\xce\x1c\xe9\x00\x00\x00\x04gAMA\x00\x00\xb1\x8f\x0b\xfca\x05\x00\x00\x00 pHYs\x00\x00\x0e\xc3\x00\x00\x0e\xc3\x01\xc7o\xa8d\x00\x00FfIDATx^\xed\xb9\xe9_\x13\xd7\xfb\xff\x1f\x08\x84-\x93\xcc\x92L\xd8B\xd4\xa8\xb8\x94 FAk\x155*\xb56\xb2D\x83\xd6b\x94\xb4\xa6\xd6Z\x17*\xd4ZK-Uj5\x12\x88\x86Z\xaa\xd4\xa6J\xad\xa5\x88T\xa8\xf5m\x11\xa3 b$\xc9\x90 [\xd6I2 \xb2F@E\xe0\xcb\xe7\xbf\xf8\xdd\xf8\x9d[ FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,160	536	NtReadFile	Buffer => \xe4(\xa5\xec\x91\xb1\xd4JW\xd4(S>N\xe7\xcb\xa4f\x10\xab\xf7\xea\x1c\x93\x81\xdet&^\xd8M\x1b\xd7\xbd6\x9f\xe6#o\x1b?FP\xaf\xe8\xb7D\xae\xfe\x03pu*Y\xff\xb4`\xbeYd\x98\x05.0x\xd6u\xaf\x9d\x1c\x00\xc4\xecP\xc3\x91#l\xa1Bk9\x8b\x05)\xf3\xe3\xdc'\xc8\x1eY\xbf\xa8\xe53\xb0>n\x1f\xd5\x1bHJ/Y\xc5\xca\xbe\xd0\x11\x04\x0b\xde\xc5\xa1\xb4\xab:\xfe\x13\xbcb\xc9f5a\xc9\xfaP}S\xe35T%\xb2O\x066\xe7\xcdI\xcf\xaam\xb5\x8b<\xc94N\xd1\xf4\x1cN \xa2a\xb8jW\x88\x91\xa5-\xc0%I\x1f\xbd\xc4*\xcdB\x96\x987W\x04\x12\x9f\x0e\xef\xa2g![Zc=\xc75?S\x9c \x81\xcb\xc4l\x1c\xda\xcbI\x02d\x17x-\xcc)\xd6\x90\xff\xd7t\x96\xc8\xa1\xf0|\xf4\xf7\xe2F\xd1\xe3\xc0\xd3R\xb6\x17\xbbe.\xfe\xf3\x86\x0b r\xa1QH\xbf\xb8\x9c\xc7p*N\xee\x9b+\x86 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,160	536	NtReadFile	Buffer => \xb4\x9f\xf5\xbe\xa5\x89q\x9a\x19%\x82E8\xd5\x13\xdft\x8b\xe8\x06:\x8b7Y\x83\x14\x08\x02\xb8\xa4\xa1!\x9c\xcf[\xa0\xe3\xd5\xe3S\x07\xec\xca*l5\xf8\x90\xe9Y\xc7e\x1c`\x13\xb2\xb2\xe3\xbdF\x9a\xf0\x02\xc5\x1e\xed\x93\xe9\xf5\x93p2Q\xb9\x88\xd0 xE)x$9\x82\xc5f\x19ux*\xe8:|-H\xc6\xe8\xcb}\xbb\x0e\xa9\x93,)\xe6\xe51\\xc9h.\x96\x8a"\x8f\xd1=|b_@"7V\xf2\xd2\xcb\xe1\x03\xafJ\x7f\x17\x84\xffxn'\x99E\xf0\xed\x17D5\xaa\x10\xdc\xcf\xf3]O\x10\xff\xa1\xc8\xb8\x17|dp^\xf4vW\xda\xfc\x11\xf6\xcaN\x99\xe6+g\xb9F\xc0\xb4f!\x12%)\xb1_P\xfdD\xef\x10L7?\xf2\xacv\xef\x96\xb5\x8b\xb0\x04pu\xa2\xbd\xba\xeb2\x81)\xeen\x80f\x17\x0e\xc5\xf7,w&\x84\xf4k\xfd$\xe8\x8fh\x93\xae\xf7}?Y\x01\xd4\x10\xb7+\xd2 \xc8\xc8\xcd\x9b\x90\xfb\x18\xbd\xdf\x8f\x08 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,160	536	NtReadFile	Buffer => \xb9R\x89\xc6 \xb2 \xa1\xa8\xc2\xfel\xcb\x05\x81\xed\xf1\xb6\xac\x7f\xa2!7n\x9a\xa5 `\xd41`\xf4\x00I#\x97e\x92Q\xcdUkw\xf9\x9f\x02\xbd\xf4x\xdeR\x13\xb4\xf8X\x8c\xfc\x803\xd8\xcdkL\x12\xb8p\x88L\xf9\x85;\xea\xa0g!\x1f\xb6|L\x8c\x98LD4\xbd\xa9*\xbczJ\x9b\xf2{ 3c\xb1&\x11\x07\x9f\xabK.\xd8W\xccC\xab"\xd5K\x93 \xfb{\xf6\x9f+n.\xa4\x8c\x14\x1e\x1aq2\x87J\xe7\xab\x98\x07v>\xda\xf5\x17ytR\xba9+\x08\xba\x00\x91\x8b\x9e\x17\x10\xfd!j\xc1 <<\xe1 \x17\xd0 \x8d\xcb\x82\xa6\xb5T\x96Ek\xf2\x1d5\xc1TY\xe1\x89Tb\xd7d\xa3P\x03\xb4\xcd\x80\x8b \xf7\xae{^\x8a\xa6Ud\x96C.S\xcdLM\xc0\x02\xcbr\xd5\xf9\xeb\xd6\xc2\xfc3\x8eH\xc2\xc1t\xd6\xb0$\xf0!\xf5\xe5\x90L\xc6\xc9\xda\\x047\x90\xea!\x1f\xe7\xb0\x023R\xdaZT\x9dn`\x07 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,160	536	NtReadFile	Buffer => \xaf\xef\x98\xc3\x94\x9b\xe2\xc8\xa1g\xb7\x98\xed1X\xa8\xf2\x97\xca]\xf7Ip\xb4]1\x99\xc5R\xa3\xc4\xc8\xf3n\xadWaC\xb2F\x12\x92\xc2 \xcaM\xdbU,\x9c\xf2zo\x8d\x0f\xff\x8d\xbd\x9dW\xbd\xc6X=8\x88\x1e)\xa7\xf8\x92>q\xaa\x95\xe6\xc0Zv\x1e\xdd1Yv<\xae\x90f\x98\x15\xf5 \xb84y\xd8\x8c\xa6\xb0\x0c\xcf\x968\x1f\x10}\xf4V\xeaP\x14r_\xfd\xd3\xfa\xbb\xd2\xcb\x1b|gI\x06]_w\xb3k\xba\x81,\xf6]kp\x03\x98u\xba\xdf\xb6\xb9\xaa\xa8\xc50w"\xb3\xa2W\xb68x8\xb2\x08\xbd\x9a\x1c%\x03\xea\xa4\x1fS\xa1\x1b\x07\x1bj\x19SP\x97H\x15\xf2\xbbq\xe8)z.\xc3\xd9\x10\xa8d(\x8b\xe2\xc8\x8bO\x1fv\xdb\x15\xd8\xe0\x1c\xfd7\xcd4Y\xf0\x00o\xd9\x18\xfc\xbd>\xad\xd8\x97\x08\xe9\x97\x96?B\xde6\xb2]h/\x9b/\x01\xda\xb7!\xea\xc2\xee\x13\xe6 \x82`\x0cA\xe6u\xeb\x9b$\xed\\xa2\x89 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => l]\xae\xd7H\x00\xd1\xc7}\xf42\xf1j\x19@\xa0\xea0\x88#\xe4\xf4\xed\xca\xe0\x7f\xb1z\xdc!L\xf1"m\x0b\x14\x18*\x03\x89s\x90\x19\xcf\xadk?\xb8 \xe3\xd3.H\x88X\x81V*\xd0\xaeD\x0f\xb9\xfe\xf6\xfd\xf0\xf6\xa6\xfb\xaed8\xd7*\x83\x17\xc2\xd8\xfe\xcb\xbaE\xa7`\x1c\xf2\x80z+\xb4J!\xb8\xef\xd1\x12W\xa5\x1a\xbb\x03\x1cTaSpOh\x8a\x02\x8d\x100\xe9a:\xcc\xafAD|;[\xc2\xdex\x97\x0c\xe4\x94Y\xe5a\xe6[\xd1D\x17\xcd\xb6\xb0\xd3\x97AL\x84$\xd0\xf2\x06\xd7\xce\x86\xcc%V\xd2\x82\x87\xb7\xb3x \xebK\x07\xb8\x94\x87\xc2E\x10\x02T >\xe6u\xebKzM\xd8m\xb4\x1cm\x12L\x9f\xe2 8\x05'\x9d\xfb$w\xffY \xdd\xffX\xffa\xca\x03\xcd\x8c`,\xf7\xa2\xb2y\x10\x17\xf8\xd6\xe5\xdf\xf5j\xac\x8bO!\x90~\x1c\x02g\xe9\xaeW\xda,m\x8a\x18w\xb0\xb4\x82\xdcf\xbe\xe3\x11\xf0\x9a\x95\xc0 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => Y\xf5n\x12\xec\x9cpdb^\xb8\xf4O\x10\xfd\x8ap\xd9X\x8bMN7\xe2\xb5\x8c\xa9\xcb8X\xa9\ \x1d\xbef(\x0b#J\x9b\xfb\x16\xd6\xed\x10m\xcc\xef`\xf8\xbc"\xd5\xc5q\x07\xac\x02\x1aO\xf4\xcb\x96UFB.\xc3\xa9\x80\x80\xcf@%|?,Iw+\xa7dsk\x18\xd4#_\xc3\xcd!^\xe5\x15i\x90\x7f&\xad\xe7\x0f\x95Y\x18\xf2\x8ca\xe3\xab\x9b\xb7\xb7v *'\xb2\xae\xff:vvQW\xd1Vdj\xa3\xbd?7\x99Pa?;\x08\xe5\xda9JuB{C\x8b\xc6d\xae@\x1cD\xe0\xd0\xf1\xe4\xb7l\xce\x0c:\x810A\xbc3s(\xbd\xb2b\xfbdy_&\x9e\xbf\xa5G*k`]pw\x84\xbf\xa1\xbaoD\x93\xdc+ \x16\x87X|]\xb8\xc5c\xa8\xbc\x88\x1b\x86\xa6\x9d\x03\xda#\xca\xe5\xadBLF7N\x81\x16\xde\xef\xd2\xa5\xdb\xe7\xee\xc6\x05P`ie\]\x10\xf3\xcc\x03z\x83\x9d\x92\xe2\x0c\xde\x94{\x03d FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => \x9f\xc2\xbaa\xac\i\x87l\xc1\xed\xbe\xceP&\xd4\x13\xf7\xe8)\xe3\x14\xe2\xf1\xf3]f\x00i\x10f\xbb\x05W+\x0faN\xf7\xf9nV\xbdG72\xb7ua\x9a^\xf3\xaai\x04c\x1an\xe9?\x83\xd7\xb8jW\x05\x99\x7f\xfd\xd1\x81\xde\x88m\x81\x9a%\xcb\x13%\x8e\x91\xe7\xc8c=(cI#j\xf29`\xdc\xdd\xb7\xb58\xe1\x1a\xbb\x9e\x13\x03\xa8x\xe64J\xa3\x81"\xc9\x11\xde\xcdWc\xa8\x11\xe3\x08\xe1\xf0\x1d\xa3k\x8c'\x1e\x91\x811\x01\x0c\xdaf\xc4\xe41\xb2>\x03\x8f\x8f6\xd78\x90e\x82\xda\xb4\xaei\x8f. \x8c\x92-\x89\xbb\xf6\x9b\xf2aa\xd7\xfcE\x13?\x93\xc0\xcc;\xab;\x94I}\xbf\x97\xdb\x88\xed\xb9\xa4\x02\xf3\xe9mP\x82 \xd7Tv\x9fb\xc3\x13\xf9\xa5\x9f\x87\x0c\x08[N\x801 \xad\xbf\x00;\xa0[\x9d\xb6\x9e\x14#I\xf0\xc3\x9e\xb9db\xf0ss\xeb\xb5\xe4s]\xc2\xe5QKm\x8e\x0fAd\xc9\xce*\xc14\xd1 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => \x84VH\xe7\xcc\x04V`\x16\xcb\xc3\xfe\xd4\x12\x9f\xf9\xf7\xe6\x03\x81#\x851\xb6H?\xcd\xc3\x16\xc8\xdeU^\x96\xe8\x12\x849\x954\x9eHIC\x9d\xcc\x1d\x8b-\x8f'\xa4Z-\xdf\xd1(\xaa\xfc3x\xb0 \xb4\xea\x17oZ0\xb6\x03\x8dk\x82_MgIeb\x94\xfb \x87Z|2q:\xf2\xcc\xf6\xa8U1\x90\xfa\xec\xad\xe7\x01X\x89\xf7\x11S{p\x86 \xbb\xf5\x0c\xce\xe0?t\xbc\x0e\xb8\xde\x03{FLz7a\x7fn{i\x8b\xed\xc9\xbeP7\xd5\xdb\x1e\xc0\xd6Mf\xae\x00\xaa\xcc\xf1\xcd\xfc\xd6\x10\xa1\xeb\x05T\x95\x13\xb5\xf7\xdf\xcc\x02\x85GI\x90BT\xcb\xe0(\x82,R\x8f\x07\xc2\xc8\xfe\xbb\xd5\x13J\x97\x15\xaf\x11\xbd*\xdc\xb3Q_\xa24j\xc9\xe2*\x84.P\x8d \xb8\x12\xd4\xe5\xafI\xa0A?\xd9\x9b3\xb8NA\x83 \xd4\x06\x98\x17\x9cT&\xd0\xc6\xfb\xd3\xee\xe4\xe2\xaf\xe9\x07V\x93\x11\xb3\xf5\xe1\xe6\x18o\x9d\x13\xe6\xf8\xae\x05 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => blicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\x02\x00\x00\x00\x0b\x00\x00\x00\x04\x00\x00\x00fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=2.0.0.0, Culture=neutral, FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => culture\x06m_name\x00\x00\x01\x08\x08\x7f\x00\x00\x00\x7f\x00\x00\x00 \x05\x00\x00\x00\x04\x03\x00\x00\x00\x1dSystem.Globalization.TextInfo\x06\x00\x00\x00\x0fm_listSeparator\x0cm_isReadOnly\x11customCultureName\x0bm_nDataItem\x11m_useUserOverride m_win32LangID\x01\x00\x01\x00\x00\x00\x01\x08\x01\x08\x06\x06\x00\x00\x00\x01,\x01 \xca\x00\x00\x00\x00\x7f\x00\x00\x00\x04\x04\x00\x00\x00%System.Globalization.NumberFormatInfo!\x00\x00\x00\x10numberGroupSizes\x12c FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => A\x1c\x17\x00A\x19\x15\x00WSr\x00D>^\x00Px\x98\x00x\xb9\xce\x00\xb1\xd4\xdf\x00\xac\xca\xcb\x00wg;\x00xg:\x00{f<\x00\x87vQ\x00{sV\x00\x85\x9b\x9b\x00\x86\xa0\xa7\x00v\x80\x8b\x00smn\x00xz\x83\x00yw~\x00odd\x00|\x81\x99\x00x\x86\xa8\x00w\x82\x9f\x00`@0\x00]9,\x00\8+\x00U3%\x00X8/\x00R/&\x00K.4\x00O13\x00I'$\x00F \x1c\x00A\x1f\x1f\x00FIg\x00J^\x80\x00_\x8e\xb3\x00\x86\xc2\xd0\x00\x90\xb3\xb5\x00\xaa\xd1\xcf\x00\x81~Q\x00\x82zN\x00\x85\x7fT\x00\x87\x88_\x00\x87\x8fz\x00\x91\xb5\xbd\x00\x8f\xb0\xb9\x00\x88\x98\x9f\x00\x82\x85\x86\x00\x81\x85\x88\x00\x81\x82\x8a\x00\x80\x83\x8e\x00\x80\x8a\xa5\x00\x84\x94\xb0\x00\x82\x94\xb1\x00\x85\x7f\x87\x00dC3\x00a@0\x00eD5\x00cF=\x00Y5+\x00T=C\x00VBO\x00J2;\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,170	536	NtReadFile	Buffer => <\x16\x11\x00;\x15\x10\x00:\x14\x0f\x007\x12\x0e\x006\x11 \x005\x10\x0c\x003\x0e\x0c\x00/ \x00,\x0b\x08\x00, \x00(\x0e\x18\x00 \x0c\x1b\x00)\x1f3\x0010M\x00+\x0f \x00<&(\x00-\x0e\x0b\x00(\x05\x03\x00Y5\x18\x00V1\x15\x00T/\x15\x00R(\x11\x00Y0\x1a\x00V,\x18\x00T1\x1d\x00U5"\x00n_]\x00d^g\x00XP[\x00L<C\x00]S^\x00dNW\x00]Xk\x00W?G\x00`NU\x00S.!\x00W.'\x00O%\x1e\x00N$\x1d\x00L%\x1d\x00K$\x1c\x00H!\x19\x00H!\x19\x00F\x1f\x17\x00C\x1c\x14\x00C\x1d\x18\x00C\x1d\x18\x00A\x1b\x16\x00@\x1a\x15\x00?\x19\x14\x00>\x18\x13\x00<\x16\x12\x00;\x15\x11\x00:\x14\x10\x007\x12\x0e\x003\x10\x0c\x000\x10\x0b\x00/\x0f\x13\x00-\x1b,\x00*\x1d.\x007:`\x00>BZ\x00ll{\x00:(/\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,180	536	NtReadFile	Buffer => t\xaf\xc4\x00w\xb1\xc7\x00\xc5\xe9\xe9\x00\xcd\xef\xef\x00\xd3\xf2\xf3\x00\xd6\xf5\xf6\x00\xd8\xf7\xf8\x00\xdb\xfa\xf9\x00\xdf\xfb\xfb\x00\xe1\xfc\xfc\x00\xcf\xf8\xf1\x00\xcf\xec\xdb\x00\xc1\xe0\xd1\x00\xbd\xde\xd8\x00\xc1\xe8\xef\x00\xbb\xe3\xe8\x00\xb8\xdf\xe7\x00\xb0\xda\xe1\x00\xb0\xd0\xdd\x00\xab\xc5\xd6\x00\xaa\xc9\xdc\x00\xa7\xc9\xe1\x00\xa7\xc5\xe5\x00\xae\xd6\xf2\x00\xa0\xc7\xf1\x00\x99\xab\xc8\x00\x8b\x8c\x9a\x00\x88\x91\xaa\x00\x82\x92\xb5\x00\x89\x8d\xb6\x00\x7f\x82\xa0\x00wn~\x00qjv\x00lY_\x00f`e\x00`Wc\x00acu\x00aYj\x00\x7f\xa9\xc8\x00s\xa5\xb3\x00i\x96\xac\x00z\xb3\xc7\x00\x80\xb7\xcc\x00{\xb4\xcd\x00{\xc2\xd5\x00n\x9f\xb4\x00w\xb1\xc3\x00x\xb4\xca\x00w\xb0\xc7\x00s\xac\xc5\x00\xc5\xe9\xe9\x00\xcd\xef\xef\x00\xd1\xf3\xf3\x00\xd6\xf5\xf6\x00\xd8\xf7\xf8\x00\xdb\xfa\xf9\x00\xdd\xfb\xfc\x00\xe0\xfc\xfc\x00\xcd\xf4\xec\x00\xd5\xef\xe0\x00\xc4\xe2\xcd\x00\xbd\xdd\xd3\x00\xbe\xe8\xef\x00\xbb\xe5\xec\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,180	536	NtReadFile	Buffer => \x9f\xdc\xe3\x00\xa8\xe6\xe0\x00\x9d\xcf\xcf\x00\x83\xa8\xac\x00\x81\xa6\xab\x00\x8e\xac\xac\x00t\x83\x82\x00w\x81\x7f\x00{\x81\x80\x00w\x88\x8a\x00p\x85\x86\x00v\x86\x8d\x00gv\x83\x00nw\x85\x00`gw\x00k\x94\xa7\x00}\xc3\xd2\x00\x83\xbc\xd5\x00t\xa6\xba\x00Mo\x8a\x00^\x9b\xc8\x00Y\x9a\xc6\x00e\xa8\xcd\x00V\x94\xbc\x00X\x93\xc0\x00R\x89\xb6\x00P\x85\xb0\x00R\x8d\xb4\x00]\x97\xba\x00d\x9d\xbd\x00f\xa1\xc4\x00V\x85\xa7\x00;Ni\x003CZ\x00\xa3\xc1\xbd\x00\xa0\xc2\xbb\x00\x94\xb9\xaf\x00\x8f\xb8\xa9\x00\x8c\xb5\xa6\x00\x8d\xb8\xa9\x00\x94\xbf\xb0\x00\x8e\xbd\xad\x00\x8f\xc0\xb2\x00\x96\xcb\xbd\x00\xa2\xd9\xcc\x00\xa9\xe3\xd8\x00\xa5\xde\xd5\x00\xac\xe8\xde\x00\x9a\xd7\xdf\x00\x8f\xc9\xe0\x00\x97\xcf\xd9\x00\xb1\xea\xe5\x00\x92\xbe\xbe\x00|\xa4\xab\x00t\x95\x9e\x00{\x9b\xa6\x00~\x9c\xa8\x00s\x94\xa1\x00\x81\x9f\xb3\x00q\x8d\xa2\x00b|\x90\x00]~\x8f\x00\x89\xc1\xd2\x00\x83\xc4\xd7\x00 FileHandle => 0x000001cc	SUCCESS	0x00000000
21:05:22,180	536	NtReadFile	Buffer => FileHandle => 0x000001cc	FAILURE	3221225489	1 time
21:05:22,210	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipLoadImageFromStream FunctionAddress => 0x4ecf4ee5 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,270	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipImageForceValidation FunctionAddress => 0x4ecaa8bc ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,290	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetImageType FunctionAddress => 0x4ecf6059 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,290	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetImageRawFormat FunctionAddress => 0x4eca66c6 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,340	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetImageWidth FunctionAddress => 0x4ec5ee59 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,340	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetImageHeight FunctionAddress => 0x4ec5eeee ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,350	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipGetImagePixelFormat FunctionAddress => 0x4eca675f ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,350	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipBitmapLockBits FunctionAddress => 0x4eca67f4 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,350	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GdipBitmapUnlockBits FunctionAddress => 0x4eca6879 ModuleHandle => 0x4ec50000	SUCCESS	0x00000000
21:05:22,390	536	FindFirstFileExW	FileName => C:\DOCUME~1	SUCCESS	0x001b1910
21:05:22,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW	SUCCESS	0x001b1910
21:05:22,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1	SUCCESS	0x001b1910
21:05:22,390	536	FindFirstFileExW	FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp	SUCCESS	0x001b1910
21:05:22,410	536	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01460000	SUCCESS	0x00000000
21:05:22,420	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcess FunctionAddress => 0x01442304 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:22,420	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcessA FunctionAddress => 0x7c80236b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,450	536	CreateProcessInternalW	ApplicationName => C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr ProcessId => 1388 CommandLine => "C:\DOCUME~1\TDW\LOCALS~1\Temp\phphotoset.scr" ThreadHandle => 0x000001d8 ProcessHandle => 0x000001d4 ThreadId => 1400 CreationFlags => 0x00000004	SUCCESS	0x00000001
21:05:22,450	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetThreadContext FunctionAddress => 0x7c839725 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,450	536	NtGetContextThread	ThreadHandle => 0x000001d8	SUCCESS	0x00000000
21:05:22,450	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReadProcessMemory FunctionAddress => 0x7c8021d0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,450	536	ReadProcessMemory	Buffer => \x00\x00@\x00 ProcessHandle => 0x000001d4 BaseAddress => 0x7ffde008	SUCCESS	0x00000001
21:05:22,460	536	LdrLoadDll	Flags => 1237156 BaseAddress => 0x00000000 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\ntdll.dll	FAILURE	3221225781
21:05:22,460	536	LdrLoadDll	Flags => 1237156 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
21:05:22,470	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtUnmapViewOfSection FunctionAddress => 0x7c90def0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
21:05:22,470	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAllocEx FunctionAddress => 0x7c809b02 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,480	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WriteProcessMemory FunctionAddress => 0x7c802213 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,490	536	WriteProcessMemory	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00q\xf9\xaf\xd95\x98\xc1\x8a5\x98\xc1\x8a5\x98\xc1\x8a<\xe0B\x8a4\x98\xc1\x8a\xc9\xb8\xd3\x8a7\x98\xc1\x8a5\x98\xc1\x8a4\x98\xc1\x8a<\xe0P\x8a4\x98\xc1\x8aRich5\x98\xc1\x8a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x02\x00w\xd9|S\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x03\x01\x0b\x01 \x00\x00 \x00\x00\x00(\x00\x00\x00\x00\x00\x00\xbf\x16\x00\x00\x00\x10\x00\x00\x00 \x00\x00\x00\x00@\x00 ProcessHandle => 0x000001d4 BaseAddress => 0x00400000	SUCCESS	0x00000001
21:05:22,490	536	WriteProcessMemory	Buffer => U\x8b\xec\xe8\x00\x00\x00\x00X-\x08\x10@\x00]\xc3\x8bT$\x043\xc0\xeb\x0b\x0f\xbe\xc93\xc8\xc1\xc1 \x8b\xc1B\x8a \x84\xc9u\xef\xc2\x04\x00V\x8bt$\x08\xeb\x19\x8a\x063\xc9<Z\x0f\x9e\xc13\xd2<A\x0f\x9d\xc2\x85\xcat\x04\x04 \x88\x06F\x80>\x00u\xe2^\xc2\x04\x00U\x8b\xec\x83\xecPVW3\xff\x89}\xecd\xa10\x00\x00\x00\x8b@\x0c\x8b@\x0c\x8b\x00\x8b@(\x89E\xe4\x8bu\x08W\x8dE\xf0P\x8dE\xd0P\xffu\xe4\xffV\x04\x85\xc0\x0f\x84k\x01\x00\x00\x8bM\xf0Sj \xb8\xec\xff\x00\x00f\x01E\xd0Xj\x0cf\x89E\xd8Xj*f\x89E\xdaXf\x89A\x08\x8bE\xf0j\x18\x83\xc0\x08[\x89E\xdcS\x8dE\xb0P\xe8\xce\x05\x00\x00h!@\x00\x00\x8dE\xd0\x89E\xb8j\x03\x8dE\xc8P\x8dE\xb0Ph\x01\x00\x10\x00\x8dE\xf4P\x89]\xb0\xffV$\x85\xc0\x0f\x85\xff\x00\x00\x00j\x04h\x00\x10\x10\x00\x8dE\xfcPW ProcessHandle => 0x000001d4 BaseAddress => 0x00401000	SUCCESS	0x00000001
21:05:22,490	536	WriteProcessMemory	Buffer => )\x83\xccg\x83A% \xfbAC/\x7f\xf7KPv'\x00\x00\x14\xbd\x12\xe3\x00P\x00\x00\xde\x13\x00\x00\x847\x00\x00\x98\x06\x00\x00\xbc^\xc1\xb5\xf7\xe1\xb3\xa4\x8b\x92\x05]\xad\xef^\xf3W.W(m\xe0\x12\xaab\xcbt\xd8\xd3}\xe5<S\xa3\x07C\xe6K\x04\x9aq@\xd8\xf4V;|:\xfa\xf7\xa1\.\x89.k^\x01\xaah\xc0Y\xad\x86es\xa4\x80c\xafd\xa5\x16%j\x95\x81\xff \x12\x7f\xf3\xb1\xf5\x82\x90\xba\xe4G$q\xf1A#jaw&7\xbf \x1f\xfaY\xaex\xe65\xe8\xeb\x11\xf9\xf0\x03\xf4\x1e\xb8Z\xdep\xc5\xae \x19\x95\xd5\x82\xdfi\xbb\xf7(4\x08m\xa5\x8e\xbaHo\xc9\x9a\xa9L\xcbB\xc4\xcd\xeb\xe9\xe1\x0eC\xe8\xa3\xbe\xacx\xa1`\x85\x84\x19\x08\x80\xe3}\x88\x8c\x04G\x84*p\xecv\\xde\xc1\xa5\x8b\x1a\xb5\xb2G\xe7\x9d\xef\xc8\xe8\xe7;\x82HE\x115/\xe9\x9b\xd1\xc4^\xed)o\xd1*\x1a\x14\x18\xa8\xe2X\xf6\x04 ProcessHandle => 0x000001d4 BaseAddress => 0x00402000	SUCCESS	0x00000001
21:05:22,490	536	WriteProcessMemory	Buffer => \x00\x00@\x00 ProcessHandle => 0x000001d4 BaseAddress => 0x7ffde008	SUCCESS	0x00000001
21:05:22,490	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetThreadContext FunctionAddress => 0x7c863aa9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:22,500	536	NtSetContextThread	ThreadHandle => 0x000001d8	SUCCESS	0x00000000
21:05:23,291	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ResumeThread FunctionAddress => 0x7c83290f ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,291	536	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x000001d8	SUCCESS	0x00000000
21:05:23,321	536	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
21:05:23,371	536	CreateThread	ThreadId => 1480 StartRoutine => 0x79f75021 Parameter => 0x00000000 CreationFlags => 0	SUCCESS	0x000001d0
21:05:23,371	536	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => OLE32.DLL	SUCCESS	0x00000000
21:05:23,371	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoWaitForMultipleHandles FunctionAddress => 0x77557151 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,371	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:23,381	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1480	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetClassLong FunctionAddress => 0x7b5122c6 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetClassLongW FunctionAddress => 0x7e41e14b ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => PostMessage FunctionAddress => 0x7b4a22fc ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => PostMessageW FunctionAddress => 0x7e418ccb ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnregisterClass FunctionAddress => 0x7b511627 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnregisterClassW FunctionAddress => 0x7e419aa4 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteAtom FunctionAddress => 0x7c8326ad ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,381	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteAtomW FunctionAddress => 0x00eaf3f1 ModuleHandle => 0x7c800000	FAILURE	3221225785
21:05:23,472	536	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\winlogon.exe	FAILURE	3221225781	1 time
21:05:23,502	536	RegOpenKeyExW	Handle => 0x000001ec Registry => 0x80000002 SubKey => Software\Microsoft\Ole	SUCCESS	0x00000000
21:05:23,512	536	RegQueryValueExW	Handle => 0x000001ec DataLength => 4 ValueName => MaximumAllowedAllocationSize Type => 1238140	FAILURE	0x00000002
21:05:23,512	536	RegCloseKey	Handle => 0x000001ec	SUCCESS	0x00000000
21:05:23,512	536	LdrLoadDll	Flags => 1238104 BaseAddress => 0x03610000 FileName => xpsp2res.dll	SUCCESS	0x00000000
21:05:23,512	536	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000000 SubKey => AppID\phphotoset.scr	FAILURE	0x00000002
21:05:23,522	536	RegOpenKeyExW	Handle => 0x000001ec Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\OLE	SUCCESS	0x00000000
21:05:23,522	536	RegQueryValueExW	Handle => 0x000001ec DataLength => 256 ValueName => DefaultAccessPermission Type => 1649616	FAILURE	0x00000002
21:05:23,522	536	RegCloseKey	Handle => 0x000001ec	SUCCESS	0x00000000
21:05:23,522	536	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000001f4 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName	SUCCESS	0x00000000
21:05:23,522	536	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000001f8 ObjectAttributes => ActiveComputerName	SUCCESS	0x00000000
21:05:23,522	536	NtQueryValueKey	Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x000001f8 ValueName => ComputerName Type => 1	SUCCESS	0x00000000
21:05:23,522	536	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000204	SUCCESS	0x00000000
21:05:23,532	536	NtSetInformationFile	FileHandle => 0x00000204 FileInformation =>	SUCCESS	0x00000000	1 time
21:05:23,542	536	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000204	SUCCESS	0x00000000
21:05:23,542	536	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb1F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000204	SUCCESS	0x00000000
21:05:23,552	536	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000001ec ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName	SUCCESS	0x00000000
21:05:23,552	536	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x00000204 ObjectAttributes => ActiveComputerName	SUCCESS	0x00000000
21:05:23,552	536	NtQueryValueKey	Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000204 ValueName => ComputerName Type => 1	SUCCESS	0x00000000
21:05:23,552	536	CreateThread	ThreadId => 1320 StartRoutine => 0x77e76c7d Parameter => 0x001a9cc8 CreationFlags => 0	SUCCESS	0x00000200
21:05:23,552	536	LdrLoadDll	Flags => 1239020 BaseAddress => 0x774e0000 FileName => OLE32	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoGetMarshalSizeMax FunctionAddress => 0x7752d6c0 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoMarshalInterface FunctionAddress => 0x7750ea71 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoUnmarshalInterface FunctionAddress => 0x7752d7f4 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => StringFromIID FunctionAddress => 0x7754659b ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoGetPSClsid FunctionAddress => 0x775197f0 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoReleaseMarshalData FunctionAddress => 0x7750df23 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DcomChannelSetHResult FunctionAddress => 0x7752b1b7 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
21:05:23,552	536	CreateThread	ThreadId => 1596 StartRoutine => 0x774fe43b Parameter => 0x001b1798 CreationFlags => 0	SUCCESS	0x0000020c
21:05:23,562	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,562	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:23,572	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,572	1320	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,592	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000	1 time
21:05:23,602	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => EncodePointer FunctionAddress => 0x7c9133df ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,602	1596	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DecodePointer FunctionAddress => 0x7c913405 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,602	1596	LdrLoadDll	Flags => 61734772 BaseAddress => 0x774e0000 FileName => OLE32.DLL	SUCCESS	0x00000000
21:05:23,602	1596	NtDelayExecution	Milliseconds => 60000	SUCCESS	0x00000000
21:05:23,602	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsWindow FunctionAddress => 0x7e429313 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetDllHandle	ModuleHandle => 0x7e410000 FileName => user32.dll	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DefWindowProcW FunctionAddress => 0x7e428d20 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLong FunctionAddress => 0x7a7bb00b ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetWindowLongW FunctionAddress => 0x7e42c2bb ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetClassLong FunctionAddress => 0x7a7bafd4 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetClassLongW FunctionAddress => 0x7e41e14b ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DestroyWindow FunctionAddress => 0x7e42b19c ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DestroyWindowW FunctionAddress => 0x00eaf371 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => PostMessage FunctionAddress => 0x7a7bb1a4 ModuleHandle => 0x7e410000	FAILURE	3221225785
21:05:23,612	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => PostMessageW FunctionAddress => 0x7e418ccb ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,652	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseThemeData FunctionAddress => 0x5ad74773 ModuleHandle => 0x5ad70000	SUCCESS	0x00000000
21:05:23,652	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseThemeDataW FunctionAddress => 0x00eaf721 ModuleHandle => 0x5ad70000	FAILURE	3221225785
21:05:23,672	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DestroyIcon FunctionAddress => 0x7e42d312 ModuleHandle => 0x7e410000	SUCCESS	0x00000000
21:05:23,702	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
21:05:23,702	1080	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteObject FunctionAddress => 0x77f16bfa ModuleHandle => 0x77f10000	SUCCESS	0x00000000
21:05:23,702	1080	RegCloseKey	Handle => 0x80000004	SUCCESS	0x00000000
21:05:23,712	1080	NtDelayExecution	Milliseconds => 1566804069	SUCCESS	0x00000000
21:05:23,722	1480	DeleteFileW	FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.504.19330217	FAILURE	0x00000000
21:05:23,722	1480	DeleteFileW	FileName => C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.504.19330217	FAILURE	0x00000000
21:05:23,732	1480	DeleteFileW	FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.504.19330247	FAILURE	0x00000000
21:05:23,742	536	ExitProcess	ExitCode => 0	SUCCESS	0x00000000